IS4: Request not valid for the application's 'userAudience' configuration

user_2155584 0
Viewed 2178

I'm trying to use external login provider in my IdentityServer4. I followed the quickstart, and everything was working fine, now I'm trying to add Microsoft login.

I added this code in IS4's Startup:

services.AddAuthentication()
        .AddMicrosoftAccount(o =>
        {
            o.SignInScheme = IdentityServer4.IdentityServerConstants.ExternalCookieAuthenticationScheme;
            o.ClientId = "yadayada";
            o.ClientSecret = "yoyoyoyo";
        });

In the Azure Portal, I've defined the scope:

  • openid
  • profile

And I'm getting this error after I entered my Microsoft username/password:

Exception: invalid_request;Description=The request is not valid for the application's 'userAudience' configuration. In order to use /common/ endpoint, the application must not be configured with 'Consumer' as the user audience. The userAudience should be configured with 'All' to use /common/ endpoint.

Exception: An error was encountered while handling the remote login. Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler.HandleRequestAsync() IdentityServer4.Hosting.FederatedSignOut.AuthenticationRequestHandlerWrapper.HandleRequestAsync() Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

EDIT: This is a bug in Asp.NET Core. Tracked here: https://github.com/dotnet/AspNetCore.Docs/issues/19795

identityserver4 asp.net-core c#
1 Answers

I was getting the same error. I was able to fix it by re-creating the app registration and picking the supported account type:

  • Accounts in any organizational directory and personal Microsoft accounts.
user_54823580
Related