Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Azure AD B2C Return with AADB2C90289 Status : ClientError #104

Closed
deepakdosaya opened this issue Aug 20, 2020 · 30 comments
Closed

Azure AD B2C Return with AADB2C90289 Status : ClientError #104

deepakdosaya opened this issue Aug 20, 2020 · 30 comments

Comments

@deepakdosaya
Copy link

Thanks for the blog, it helped me a lot to setup Sign in Apple for my mobile app. But unfortunetly I am not getting error while coming back from Apple to Azure return url

Reason : We encountered an error connecting to the identity provider. Please try again later.

Name : Federate with an identity provider
CorrelationId : 8560c0b8-28db-4423-bfaa-7e86f8d47035
Category : B2C
Activity Status
Status : ClientError
Reason : We encountered an error connecting to the identity provider. Please try again later.

Any clue what is going wrong.

Thanks in advance

Deepak
@deepakdosaya
Copy link
Author

deepakdosaya commented Aug 21, 2020 via email

@JasSuri
Copy link
Contributor

JasSuri commented Aug 22, 2020

99% this is incorrect secret being provided to AAD B2C. If you provide a correlation id, we can check.

@deepakdosaya
Copy link
Author

deepakdosaya commented Aug 22, 2020 via email

@rcnjstudent
Copy link

rcnjstudent commented Aug 22, 2020 •
edited

I had the same issue and was fighting with this for two weeks getting frustrated. I figured out the solution to this though, at least for what was happening with me. There's a flaw in the documentation screenshot for the Secret Key Generation where they show the appleServiceId value as being "com.yourcompany.app1" however, this is incorrect. You should be putting the actual Service Identifier, so in their example's case it's "com.your-company.b2cservice1". Additionally, I mistakenly took my Token Key ID and used that as the Team ID (which is on one of the main screens in the Apple Developer site), which also caused the issue.

Once I fixed that the service worked for me, albeit partially. For some reason, their callback URL doesn't capture the First Name, Last Name, Email ID of the user (and that's only sent the first time they successfully log in). I basically just get their Unique NameIdentifier which is just a large random string of numbers and letters. Maybe someone can figure out how to get that working better? I believe Firebase Auth captures this info.

@deepakdosaya
Copy link
Author

deepakdosaya commented Aug 24, 2020 via email

@rcnjstudent
Copy link

For some reason, your image didn't come through. Can you try reposting it again?

@deepakdosaya
Copy link
Author

image

@rcnjstudent
Copy link

Oh, yeah so for some reason their oAuth resp does not parse out the supplied email address (even if they choose to hide their real address and use their anonymized relay address instead), First Name or Last Name from the Apple callback. I do believe it'll do this for other oAuth providers like Google/Facebook. I don't know why it doesn't do this for Apple, it seems like a pretty straightforward thing to do. This means that you would have to request their email address, first and last names separately through this form, which I think could possibly violate the terms of Sign in With Apple's privacy.

@deepakdosaya
Copy link
Author

Exactly, I do see apple returns display name back but I do not see email address and given_name. Anyone else is facing the same issue?

@rcnjstudent
Copy link

This person's ASP.net Core project pulls back all the info in the response, but they're not using B2C, they're using their own authentication program they created:
-https://github.com/martincostello/SignInWithAppleSample/
-Here's his live action demo site - https://signinwithapple.azurewebsites.net/

To anyone reading this who's more of an advanced developer-is there a way to do what he did on his callback process with B2C somehow?

@JasSuri
Copy link
Contributor

JasSuri commented Aug 25, 2020

If anyone can share a sample of the token received back from Apple, i can determine how to get the other fields out of it.

@JasSuri
Copy link
Contributor

JasSuri commented Aug 25, 2020 •
edited

I think the response looks like this

   "state": "xxx",
   "code": "yyy",
   "id_token": "zzz",
   "user": {
        "name": {
            "firstName":"John",
            "lastName":"Doe"
        },
        "email":"example@privaterelay.appleid.com"
    }
}

Since the email and name is not returned in the actual token, we don't have the ability to parse it.

@deepakdosaya
Copy link
Author

deepakdosaya commented Aug 25, 2020 via email

@JasSuri
Copy link
Contributor

JasSuri commented Aug 25, 2020

Thats a token from B2C, not from Apple

@rcnjstudent
Copy link

I think the response looks like this

   "state": "xxx",
   "code": "yyy",
   "id_token": "zzz",
   "user": {
        "name": {
            "firstName":"John",
            "lastName":"Doe"
        },
        "email":"example@privaterelay.appleid.com"
    }
}

Since the email and name is not returned in the actual token, we don't have the ability to parse it.

That's not exactly true - Apple does send the full information back in a Token the first time the user logs in, which you need to decode . Here's a quick example I found for decoding what Apple generally signs back: https://sarunw.com/posts/sign-in-with-apple-3/#what-to-validate

Firebase Auth is able to parse this information out for me automatically, why can't B2C?

@JasSuri
Copy link
Contributor

JasSuri commented Aug 25, 2020 •
edited

We can parse the claims in the token

{
  "iss": "https://appleid.apple.com",
  "aud": "com.sarunw.siwa",
  "exp": 1577943613,
  "iat": 1577943013,
  "sub": "xxx.yyy.zzz",
  "nonce": "nounce",
  "c_hash": "xxxx",
  "email": "xxxx@privaterelay.appleid.com",
  "email_verified": "true",
  "is_private_email": "true",
  "auth_time": 1577943013
}

Then Apple send other information outside the token.
All other IdPs in the world send this information as part of the token. AAD B2C models an interface for an OpenID/OAuth response, and nothing in the OpenId spec stipulates what Apple did (to send ID info outside the id_token itself). Until we make a propriety interface for Apple specifically, we wont be able to parse this info from outside the token itself, ie the user object.

@JasSuri JasSuri mentioned this issue Sep 12, 2020
Closed
@cljung
Copy link
Contributor

cljung commented Sep 25, 2020

@deepakdosaya - if not solved already, make sure your token (client secret) contains the kid + alg in the headers. Otherwise you get this error because https://appleid.apple.com/auth/token rejects the call with error invalid_client. Good read can be found here https://fluffy.es/how-to-solve-invalid_client-error-in-sign-in-with-apple/

@deepakdosaya
Copy link
Author

deepakdosaya commented Sep 25, 2020 via email

@JasSuri JasSuri closed this as completed Nov 26, 2020
@charlesroddie
Copy link

We are getting the same error but not reliably.

Name : Federate with an identity provider
CorrelationId : 1469bd71-3a2c-407b-bcaa-1fc7bb6cd455
Category : B2C
Activity Status
Status : ClientError
Reason : We encountered an error connecting to the identity provider. Please try again later.

We can't reproduce it but the store reviewers get the error. Could a client secret issue cause login issues some but not all of the time?

@JasSuri
Copy link
Contributor

JasSuri commented Dec 29, 2020

You should open a support case with Microsoft, especially when you have an intermittent issue.

@kevcrooks kevcrooks mentioned this issue Jan 7, 2021
Closed
@charlesroddie charlesroddie mentioned this issue Jan 7, 2021
Closed
@rcnjstudent rcnjstudent mentioned this issue Feb 6, 2021
Open
@bhavin915
Copy link

AADB2C90289: We encountered an error connecting to the identity provider. Please try again later.
Correlation ID: 9698573e-8241-4689-9688-04e98454d25f
Timestamp: 2022-02-03 14:33:09Z

Can you please check, what we are doing wrong against this correlation ID

@JasSuri
Copy link
Contributor

JasSuri commented Feb 7, 2022 •
edited

A bad request is made to https://*****.uk/token. Check with the identity provider to determine the exact cause. We got a HTTP 400 back from this identity provider.

@bhavin915
Copy link

A bad request is made to https://*****.uk/token. Check with the identity provider to determine the exact cause. We got a HTTP 400 back from this identity provider.

Error parsing JWT: The parsed JWT indicates it was signed with the HS256 signature algorithm. This is the error we got from the identity provider. We have mentioned in metadata to sign token token_signing_algorithm as RS512 can you please help

@javidgahramanov
Copy link

deepakdosaya could you please help with this issue ?

@mathiso
Copy link

mathiso commented Mar 21, 2022

We are getting the same error but not reliably.

Name : Federate with an identity provider
CorrelationId : 1469bd71-3a2c-407b-bcaa-1fc7bb6cd455
Category : B2C
Activity Status
Status : ClientError
Reason : We encountered an error connecting to the identity provider. Please try again later.

We can't reproduce it but the store reviewers get the error. Could a client secret issue cause login issues some but not all of the time?

We area having the same issue when Apple is reviewing our app. It has worked has expected until now. We have made no changes but they can not sign in. Any solution for this?

@kimjamia
Copy link

We saw this happening when a user was using a VPN. Without the VPN, login worked normally. Immediately after re-enabling VPN, the problem resurfaced.

We managed to get full B2C logs of this, so I filed a support ticket.

@paxbun
Copy link

paxbun commented Mar 9, 2023

We are having the same problem with an already running service. We have 10K users signed in with Apple, and no changes to the code ever since.

@JasSuri
Copy link
Contributor

JasSuri commented Mar 9, 2023

We are having the same problem with an already running service. We have 10K users signed in with Apple, and no changes to the code ever since.

Apple rotate keys every 6 months, possible the key expired.

Error parsing JWT: The parsed JWT indicates it was signed with the HS256 signature algorithm. This is the error we got from the identity provider. We have mentioned in metadata to sign token token_signing_algorithm as RS512 can you please help

Usually this happens if the key you setup in B2C Policy Keys is a symmetric key, instead of an asymmetric key.

@paxbun
Copy link

paxbun commented Mar 9, 2023 •
edited

Apple rotate keys every 6 months, possible the key expired.

The documentation says Azure automatically renews the client secret... The "Renew secret" button also didn't work. I registered a new key on the Apple developer website, and now it works it also didn't work, but deleting the Apple identity provider and recreating it solved the problem.

However, for accounts that failed to sign up due to the key expiry, the private email address is not included in the API connector request after key renewal, even after deleting the corresponding user in the Azure portal. For these accounts, users must click the "Stop using Sign in with Apple" button in their Apple ID account settings.

@tbr09
Copy link

tbr09 commented Oct 4, 2023

I had the same issue and was fighting with this for two weeks getting frustrated. I figured out the solution to this though, at least for what was happening with me. There's a flaw in the documentation screenshot for the Secret Key Generation where they show the appleServiceId value as being "com.yourcompany.app1" however, this is incorrect. You should be putting the actual Service Identifier, so in their example's case it's "com.your-company.b2cservice1". Additionally, I mistakenly took my Token Key ID and used that as the Team ID (which is on one of the main screens in the Apple Developer site), which also caused the issue.

Once I fixed that the service worked for me, albeit partially. For some reason, their callback URL doesn't capture the First Name, Last Name, Email ID of the user (and that's only sent the first time they successfully log in). I basically just get their Unique NameIdentifier which is just a large random string of numbers and letters. Maybe someone can figure out how to get that working better? I believe Firebase Auth captures this info.

I faced the same issue, your clue helped a lot. I added the correct appleServiceId to Function App which generates a token and it worked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests