OpenIdConnectOptions DI StateDataFormat/DataProtector different purposes

[joshhubers]

Describe the bug

When I dependency inject my OpenIdConnectOptions and access the StateDataFormat the DataProtector that is used has a different purpose than what is being used internally by the rest of the framework.

I have a custom Open Id Connect server with a custom endpoint that requires the 'state' parameter to be manually created. (Login/Logout functionality working fine. Can post Startup config if needed) To create the state I use the following:

  private string GenerateState()
  {
    var state = GenerateNonce();
    AuthenticationProperties authProperties = new AuthenticationProperties
    (
      new Dictionary<string, string>
      {
        { OpenIdConnectDefaults.UserstatePropertiesKey, state },
      }
    );

    authProperties.RedirectUri = "http://localhost:5000";

    //This StateDataFormat does not use the correct DataProtector
    return OpenIdOptions.CurrentValue.StateDataFormat.Protect(authProperties);
  }

Where openIdOptions is direct injected. From verbose logging I can see when the method is called and uses the behind the scenes DataProtector:

trce: Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector[31]
Performing protect operation to key {cdf7e79b-8d1a-4e7e-a093-fea402dbba8c} with purposes ('/app/DataManager', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', '', 'v1').

Later down the pipe the authentication happens on the Open Id Connect server and when the server comes back to the client I get the following error:

An unhandled exception has occurred while executing the request.                                                                                                                                             
System.Exception: An error was encountered while handling the remote login.                                           
System.Exception: Unable to unprotect the message.State.

Source code location

My assumption is that the state is not being decrypted properly when it returns to the client because I see this in the logs:

trce: Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector[5]
Performing unprotect operation to key {cdf7e79b-8d1a-4e7e-a093-fea402dbba8c} with purposes ('/app/DataManager', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', 'oidc', 'v1').

Unprotect happening in the framework here

The key difference being when encrypting it has an empty purpose, and when decrypting it includes 'oidc' in it's purpose.

I'm new to the whole data protection realm, but from the docs it says that the purpose is hashed in the encryption process which may be the source of the decryption issue.

I have also tried to manually set the DataProtectionProvider on the OpenIdConnectOptions to use a provider that would return a DataProtector with the same purpose, but internally it would still use the same DataProtector as if it were instantiating a new protector regardless of the one supplied.

Default protector/StateDataFormat being created here

Expected behavior

I would expect that the DataProtector used behind the scenes in the framework and the one that is DI from OpenIdConnectOptions to be the same with the same purposes.

Additional context

.NET Core SDK (reflecting any global.json):
 Version:   3.0.100-preview8-013656
 Commit:    8bf06ffc8d

Runtime Environment:
 OS Name:     ubuntu
 OS Version:  19.04
 OS Platform: Linux
 RID:         ubuntu.19.04-x64
 Base Path:   /usr/share/dotnet/sdk/3.0.100-preview8-013656/

Host (useful for support):
  Version: 3.0.0-preview8-28405-07
  Commit:  d01b2fb7bc

.NET Core SDKs installed:
  3.0.100-preview8-013656 [/usr/share/dotnet/sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.App 3.0.0-preview8.19405.7 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 3.0.0-preview8-28405-07 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

Using docker image - mcr.microsoft.com/dotnet/core/sdk:3.0.100-preview8-disco

[Tratcher]

I have a custom Open Id Connect server with a custom endpoint that requires the 'state' parameter to be manually created.

The client is sending data to the server via a pre-agreed format of the state parameter? That's a poor practice, it's not going to work with many clients. The state parameter is intended to be opaque to the server, it only needs to round trip to the client. You should use a custom top level parameter for that.

The purpose is applied just before creating the formatter here. You don't need to replace options.DataProtectionProvider, you need to replace options.StateDataFormat with one that doesn't use a data protection provider with added purposes.

[joshhubers]

Sorry @Tratcher - I worded that state parameter poorly. It's not that the state parameter is custom in any way or in a certain format, I just have to create the state parameter manually as the endpoint being used expects a state parameter. (Which normally is handled all internally by the OIDC package).

Edit: How it's being used for example. (Razor).

<a href=@($"https://test.org/custom/change-organization/{organization.OrganizationCode}?client_id=data-manager&redirect_uri=http://localhost:5000/signin-oidc&response_type=code id_token&scope=openid custom profile&nonce={GenerateNonce()}&state={GenerateState()}")>@organization.Name</a>

Isn't it true though that supplying the OpenIdConnectOptions with a DataProtectionProvider should work just as well?

https://github.com/aspnet/AspNetCore/blob/4a42afc5aea63750638e118560d43db04bd9ccc2/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectPostConfigureOptions.cs#L31-L45

Looks like if a DataProtectionProvider is not provided one will be created and then use that DataProtectionProvider to create the StateDataFormat via CreateProtector

If I understand that correctly I would assume the following would work:

 98       services.AddSingleton<OIDCDataProtectionProvider>();
 99       services.AddSingleton<IConfigureOptions<OpenIdConnectOptions>, OidcOptionsSetup>();
100 
101       services.AddAuthentication(options => {
102         options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
103         options.DefaultChallengeScheme = "oidc";
104       })
105         .AddCookie()
106         .AddOpenIdConnect("oidc", _ => {});

...

  5   public class OIDCDataProtectionProvider : IDataProtectionProvider  
  6   {                                         
  7     private IDataProtectionProvider _root;                                                       
  8                                                 
  9     public OIDCDataProtectionProvider(IDataProtectionProvider root)
 10     {                                                                 
 11       _root = root;                                                   
 12     }                                                                                 
 13                                                                                       
 14     public IDataProtector CreateProtector(string purpose)         
 15     {                                                                
 16       return _root.CreateProtector("oidc");
 17     }                                                                                    
 18   }    

...

 11     IConfiguration _config;                                           
 12     IDataProtectionProvider _protectionProvider;                                      
 13                                                                                       
 14     public OidcOptionsSetup(IConfiguration config, OIDCDataProtectionProvider protectionProvider)
 15     {                                                                
 16       _config = config;
 17       _protectionProvider = protectionProvider;                                          
 18     }                                                                                    
 19 
 20     public void Configure(string name, OpenIdConnectOptions options)
 21     {
 22       string oidcClientId = _config.GetSection("OpenId")["ClientId"];
 23       options.ClientId = oidcClientId;
 24       options.ClientSecret = "secret";
 25       options.Authority = "https://test.org";
 26       options.ResponseType = "code id_token";
 27       options.Scope.Clear();
 28       options.Scope.Add("openid");
 29       options.Scope.Add("custom");
 30       options.GetClaimsFromUserInfoEndpoint = true;
 31       options.SaveTokens = true;
 32       options.RequireHttpsMetadata = false;
 33 
 34       //Map claims
 35       options.ClaimActions.Remove("amr");                                                                                                                                                                                                 
 36       options.ClaimActions.MapJsonKey("custom_org", "custom_org");                                                                                                                                                                    
 37       options.ClaimActions.MapJsonKey("custom_role", "custom_role");                                                                                                                                                                  
 38       options.ClaimActions.MapJsonKey("custom_valid_org", "custom_valid_org");                                                                                                                                                        
 39                                                                                                                                                                                                                                           
 40       options.DataProtectionProvider = _protectionProvider;                                                                                                                                                                               
 41     }                                                                                                                                                                                                                                     
 42                                                                                                                                                                                                                                           
 43     public void Configure(OpenIdConnectOptions options)                                                                                                                                                                                   
 44     {                                                                                                                                                                                                                                     
 45       Configure(Microsoft.Extensions.Options.Options.DefaultName, options);                                                                                                                                                               
 46     }                                                                                                                                                                                                                                     
 47   }    

[Tratcher]

Yes, that data protection override should work. You should be able to attach the debugger and step into OidcOptionsSetup and OpenIdConnectPostConfigureOptions to see if everything is being setup as expected.

You seem to be bypassing the Challenge component of the OIDC handler? You can't just call the /signin-oidc endpoint, they expect a correlation and nonce cookie that was issued during the initial challenge.

[joshhubers]

@Tratcher - Yea, I'm new to OIDC and noticed that while digging through the code as well that I would need those. Is it the correlation and nonce that was issued during the initial challenge (login I'm assuming?) or can I just use a new correlation id and nonce?

I know it's off topic and I understand if you wouldn't know (not your problem or your code) or can't invest time, but if this endpoint is another challenge couldn't I provide a new correlation id and nonce?

Unfortunately the engineer who created it is no longer here and it's undocumented.

I'm looking into debugging the issue.

Thanks for the help.

[Tratcher]

You shouldn't be generating your own challenges here, you should go through the Challenge APIs instead. We won't be able to offer much help for a custom challenge.

[joshhubers]

Thanks for your help @Tratcher. I will close the issue while I explore your suggested options.