Issue validation failed error for Azure App Registration (even in sample application from quickstart)?

user_376692 0
Viewed 265

I am working on extending an existing .Net 4.7 WebForms web application hosted on Azure with OAuth. To accomplish this, I created a new App Registration in Azure and tried to integrate it using OWIN with the following code

    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            // Sets the ClientId, authority, RedirectUri as obtained from web.config
            ClientId = clientId,
            Authority = authority,
            RedirectUri = redirectUri,
            // PostLogoutRedirectUri is the page that users will be redirected to after sign-out. In this case, it is using the home page
            PostLogoutRedirectUri = redirectUri,
            Scope = OpenIdConnectScope.OpenIdProfile,
            // ResponseType is set to request the code id_token - which contains basic information about the signed-in user
            ResponseType = OpenIdConnectResponseType.CodeIdToken,
            // OpenIdConnectAuthenticationNotifications configures OWIN to send notification of failed authentications to OnAuthenticationFailed method
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = OnAuthenticationFailed
            }
        }
    ) ;

The authentication was successful, but on redirect back to my application I got the following error:

IDX10205: Issuer validation failed. Issuer: '[PII is hidden]'. Did not match: validationParameters.ValidIssuer: '[PII is hidden]' or validationParameters.ValidIssuers: '[PII is hidden]'

To isolate the problem from my existing web application I went to Azure portal and downloaded the sample application using Quickstart option from the menu:

Menu at Azure portal

This resulted in a very similar error:

Error: IDX10205: Issuer validation failed. Issuer: 'System.String'. Did not match: validationParameters.ValidIssuer: 'System.String' or validationParameters.ValidIssuers: 'System.String'.

From that I concluded that something is wrong with my App Registration potentially. I tried to do a research and found some topics to set accessTokenAcceptedVersion from null to 2 in the manifest settings. However this setting was already correct and the portal disallowed me to set to anything else (to downgrade the version).

Any ideas what else I could try?

azure-web-app-service oauth-2.0 azure webforms asp.net
1 Answers

Apparently what I missed is that authentication happened on OAuth server, but the issue validation takes place directly in your application once the user is authenticated. This is set by TokenValidationParameters in OpenIdConnectAuthenticationOptions class.

Add the following line to OpenIdConnectAuthenticationOptions to bypass that validation (only do it for test purposes!):

 TokenValidationParameters = new TokenValidationParameters() { ValidateIssuer = false }
user_3766920
Related