I have configured my .NET5 blazor server app to use Azure B2C for authentication, and it works fine on localhost when I set https://localhost:5000/signin-oidc as a redirect URI, but when I switch it to use my public domain and then publish the website to Azure I get this in the log on the server, and the browser renders a 500 trying to redirect to /MicrosoftIdentity/Account/Error
2021-03-18T00:30:59.069927572Z [00:30:59 WRN] The cookie '.AspNetCore.OpenIdConnect.Nonce.CfDJ8I_wgoDb1d1Kh7HcYY9-b0zqUwrvd-eBMsOMBS0O9MSIwSHKuDhE2EHY_srrCjT3463463463467HU2JZ1CrnpbbOKG3DYh978UWlVpztUe55CfUzr0mmaL5__drc-v8IU-aWwTCIjISYv9X68YgBSpa41ilw8DEUPEFvA' has set 'SameSite=None' and must also set 'Secure'.
2021-03-18T00:30:59.090919125Z [00:30:59 WRN] The cookie '.AspNetCore.Correlation.n4oDOu_6H3G58xPPXaJ0dYv56G6wek5S5DE6_TdbGeg' has set 'SameSite=None' and must also set 'Secure'.
2021-03-18T00:30:59.124097767Z [00:30:59 INF] AuthenticationScheme: OpenIdConnect was challenged.
2021-03-18T00:30:59.135738852Z [00:30:59 INF] Executed action Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI) in 2025.9109ms
2021-03-18T00:30:59.141185892Z [00:30:59 INF] Executed endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
2021-03-18T00:30:59.144883119Z [00:30:59 INF] Request finished HTTP/1.1 GET http://studio.mydomain.com/MicrosoftIdentity/Account/SignIn - - - 302 0 - 2110.6962ms
2021-03-18T00:31:02.961972761Z [00:31:02 INF] Request starting HTTP/1.1 POST http://studio.mydomain.com/signin-oidc application/x-www-form-urlencoded 655
2021-03-18T00:31:03.032778677Z [00:31:03 WRN] '.AspNetCore.Correlation.n4oDOu_6H343563463463wek5S5DE6_TdbGeg' cookie not found.
2021-03-18T00:31:03.033681584Z [00:31:03 INF] Error from RemoteAuthentication: Correlation failed..
2021-03-18T00:31:03.050863209Z [00:31:03 INF] Request finished HTTP/1.1 POST http://studio.mydomain.com/signin-oidc application/x-www-form-urlencoded 655 - 302 0 - 74.3430ms
2021-03-18T00:31:03.126354159Z [00:31:03 INF] Request starting HTTP/1.1 GET http://studio.mydomain.com/MicrosoftIdentity/Account/Error - -
2021-03-18T00:31:03.148067518Z [00:31:03 INF] OpenIdConnect was not authenticated. Failure message: Not authenticated
2021-03-18T00:31:03.149001925Z [00:31:03 INF] Executing endpoint '/Account/Error'
2021-03-18T00:31:03.159059298Z [00:31:03 INF] Route matched with {page = "/Account/Error", area = "MicrosoftIdentity", action = "", controller = ""}. Executing page /Account/Error
2021-03-18T00:31:03.166577353Z [00:31:03 INF] Executing handler method Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Pages.Account.ErrorModel.OnGet - ModelState is Valid
2021-03-18T00:31:03.167801962Z [00:31:03 INF] Executed handler method OnGet, returned result .
2021-03-18T00:31:03.168506467Z [00:31:03 INF] Executing an implicit handler method - ModelState is Valid
2021-03-18T00:31:03.169229872Z [00:31:03 INF] Executed an implicit handler method, returned result Microsoft.AspNetCore.Mvc.RazorPages.PageResult.
2021-03-18T00:31:03.318943164Z [00:31:03 INF] Executed page /Account/Error in 159.3968ms
2021-03-18T00:31:03.320068472Z [00:31:03 INF] Executed endpoint '/Account/Error'
2021-03-18T00:31:03.465075330Z [00:31:03 ERR] An unhandled exception has occurred while executing the request.
When I compare to localhost logs such as this one, where authentication is successful, there are a few key differences I note:
20:55:48 INF] Executing endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
[20:55:48 INF] Route matched with {area = "MicrosoftIdentity", action = "SignIn", controller = "Account", page = ""}. Executing controller action with signature Microsoft.AspNetCore.Mvc.IActionResult SignIn(System.String) on controller Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController (Microsoft.Identity.Web.UI).
[20:55:48 INF] Executing ChallengeResult with authentication schemes (["OpenIdConnect"]).
[20:55:48 INF] AuthenticationScheme: OpenIdConnect was challenged.
[20:55:48 INF] Executed action Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI) in 77.4856ms
[20:55:48 INF] Executed endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
[20:55:48 INF] Request finished HTTP/2 GET https://localhost:5001/MicrosoftIdentity/Account/SignIn - - - 302 0 - 265.8197ms
[20:55:54 INF] Executed endpoint '/_blazor'
[20:55:54 INF] Request finished HTTP/1.1 GET https://localhost:5001/_blazor?id=26iMiwRrnVJr6bgoSUV88A - - - 101 - - 40279.1585ms
[20:55:55 INF] Request starting HTTP/2 POST https://localhost:5001/signin-oidc application/x-www-form-urlencoded 1578
[20:55:55 INF] AuthenticationScheme: Cookies signed in.
[20:55:55 INF] Request finished HTTP/2 POST https://localhost:5001/signin-oidc application/x-www-form-urlencoded 1578 - 302 0 - 365.7586ms
[20:55:55 INF] Request starting HTTP/2 GET https://localhost:5001/ - -
Localhost is using HTTP/2 and TLS (https) whereas the Azure version is listening http on port 8080 inside its container, so maybe that's a factor? I have a SSL cert from letsencrypt on the Azure app, so that shouldn't be a factor, and regular https unauthenticated views work just fine.
In my startup.cs I have this:
services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAdB2C");
services.Configure<CookiePolicyOptions>(options =>
{
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.AddAntiforgery(options =>
{
options.Cookie.SameSite = SameSiteMode.None;
});
The cookiepolicyoptions and antiforgery stuff was added in an attempt to fix the problem, but so far nothing has been successful, and I think I need advice. Anyone seen similar? - Thanks
