ASP.Net Azure OpenId integration










1















I am trying to create a project that uses Azure AD for SSO authentication. The azure side of the app has been configured and I was able to get SAML authentication working with the following code:



app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions

Wtrealm = realm,
MetadataAddress = adfsMetadata
);


Configured this way the site works fine for web pages, but I also need to be able to have API calls that are called from a native client. I would like to use JWTs for authentication for the native apps and found documentation on how to set up a separate native application that serves up JWTs. I found instructions on using the Add Connected Service to add authentication to a blank site here and it seemed to configure the site to use OpenId with the following code in my Startup.Auth.cs file being created:



IdentityModelEventSource.ShowPII = true;

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions

ClientId = clientId,
Authority = Authority,
PostLogoutRedirectUri = postLogoutRedirectUri
);


Unfortunately when I run the newly configured blank site I get the following error:




IDX10501: Signature validation failed. Unable to match keys:
'Vxa8HJ8gNB1XfxYnIDHBl2YuSFc', token:
'"typ":"JWT","alg":"RS256","x5t":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc","kid":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc".{"aud":"c13f71a0-e658-4432-a61e-24140f2b5890","iss":"https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/","iat":1542235664,"nbf":1542235664,"exp":1542239564,"aio":"ASQA2/8JAAAA6+NtWgTWs4mQi7gcoqDJMWDjmQtgxL79oC3U112+XjI=",...




I've looked at the OpenId metadata for my app and key Vxa8HJ8gNB1XfxYnIDHBl2YuSFc isn't in there anywhere. Is there something simple that I have missed?



Edit




It looks like the authority that was configured was



https://login.microsoftonline.com/tenant









share|improve this question
























  • which authority did you use?

    – Jean-Marc Prieur
    Nov 15 '18 at 6:33











  • I added the authority above with a placeholder for our tenant id.

    – James
    Nov 15 '18 at 14:59











  • Do you want to try with login.microsoftonline.comtenant/v2.0 ?

    – Jean-Marc Prieur
    Nov 15 '18 at 19:05












  • I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

    – James
    Nov 15 '18 at 19:13















1















I am trying to create a project that uses Azure AD for SSO authentication. The azure side of the app has been configured and I was able to get SAML authentication working with the following code:



app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions

Wtrealm = realm,
MetadataAddress = adfsMetadata
);


Configured this way the site works fine for web pages, but I also need to be able to have API calls that are called from a native client. I would like to use JWTs for authentication for the native apps and found documentation on how to set up a separate native application that serves up JWTs. I found instructions on using the Add Connected Service to add authentication to a blank site here and it seemed to configure the site to use OpenId with the following code in my Startup.Auth.cs file being created:



IdentityModelEventSource.ShowPII = true;

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions

ClientId = clientId,
Authority = Authority,
PostLogoutRedirectUri = postLogoutRedirectUri
);


Unfortunately when I run the newly configured blank site I get the following error:




IDX10501: Signature validation failed. Unable to match keys:
'Vxa8HJ8gNB1XfxYnIDHBl2YuSFc', token:
'"typ":"JWT","alg":"RS256","x5t":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc","kid":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc".{"aud":"c13f71a0-e658-4432-a61e-24140f2b5890","iss":"https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/","iat":1542235664,"nbf":1542235664,"exp":1542239564,"aio":"ASQA2/8JAAAA6+NtWgTWs4mQi7gcoqDJMWDjmQtgxL79oC3U112+XjI=",...




I've looked at the OpenId metadata for my app and key Vxa8HJ8gNB1XfxYnIDHBl2YuSFc isn't in there anywhere. Is there something simple that I have missed?



Edit




It looks like the authority that was configured was



https://login.microsoftonline.com/tenant









share|improve this question
























  • which authority did you use?

    – Jean-Marc Prieur
    Nov 15 '18 at 6:33











  • I added the authority above with a placeholder for our tenant id.

    – James
    Nov 15 '18 at 14:59











  • Do you want to try with login.microsoftonline.comtenant/v2.0 ?

    – Jean-Marc Prieur
    Nov 15 '18 at 19:05












  • I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

    – James
    Nov 15 '18 at 19:13













1












1








1


4






I am trying to create a project that uses Azure AD for SSO authentication. The azure side of the app has been configured and I was able to get SAML authentication working with the following code:



app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions

Wtrealm = realm,
MetadataAddress = adfsMetadata
);


Configured this way the site works fine for web pages, but I also need to be able to have API calls that are called from a native client. I would like to use JWTs for authentication for the native apps and found documentation on how to set up a separate native application that serves up JWTs. I found instructions on using the Add Connected Service to add authentication to a blank site here and it seemed to configure the site to use OpenId with the following code in my Startup.Auth.cs file being created:



IdentityModelEventSource.ShowPII = true;

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions

ClientId = clientId,
Authority = Authority,
PostLogoutRedirectUri = postLogoutRedirectUri
);


Unfortunately when I run the newly configured blank site I get the following error:




IDX10501: Signature validation failed. Unable to match keys:
'Vxa8HJ8gNB1XfxYnIDHBl2YuSFc', token:
'"typ":"JWT","alg":"RS256","x5t":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc","kid":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc".{"aud":"c13f71a0-e658-4432-a61e-24140f2b5890","iss":"https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/","iat":1542235664,"nbf":1542235664,"exp":1542239564,"aio":"ASQA2/8JAAAA6+NtWgTWs4mQi7gcoqDJMWDjmQtgxL79oC3U112+XjI=",...




I've looked at the OpenId metadata for my app and key Vxa8HJ8gNB1XfxYnIDHBl2YuSFc isn't in there anywhere. Is there something simple that I have missed?



Edit




It looks like the authority that was configured was



https://login.microsoftonline.com/tenant









share|improve this question
















I am trying to create a project that uses Azure AD for SSO authentication. The azure side of the app has been configured and I was able to get SAML authentication working with the following code:



app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions

Wtrealm = realm,
MetadataAddress = adfsMetadata
);


Configured this way the site works fine for web pages, but I also need to be able to have API calls that are called from a native client. I would like to use JWTs for authentication for the native apps and found documentation on how to set up a separate native application that serves up JWTs. I found instructions on using the Add Connected Service to add authentication to a blank site here and it seemed to configure the site to use OpenId with the following code in my Startup.Auth.cs file being created:



IdentityModelEventSource.ShowPII = true;

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions

ClientId = clientId,
Authority = Authority,
PostLogoutRedirectUri = postLogoutRedirectUri
);


Unfortunately when I run the newly configured blank site I get the following error:




IDX10501: Signature validation failed. Unable to match keys:
'Vxa8HJ8gNB1XfxYnIDHBl2YuSFc', token:
'"typ":"JWT","alg":"RS256","x5t":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc","kid":"Vxa8HJ8gNB1XfxYnIDHBl2YuSFc".{"aud":"c13f71a0-e658-4432-a61e-24140f2b5890","iss":"https://sts.windows.net/8948afa6-51e3-4041-8303-5688ba9c8135/","iat":1542235664,"nbf":1542235664,"exp":1542239564,"aio":"ASQA2/8JAAAA6+NtWgTWs4mQi7gcoqDJMWDjmQtgxL79oC3U112+XjI=",...




I've looked at the OpenId metadata for my app and key Vxa8HJ8gNB1XfxYnIDHBl2YuSFc isn't in there anywhere. Is there something simple that I have missed?



Edit




It looks like the authority that was configured was



https://login.microsoftonline.com/tenant






c# azure azure-active-directory






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 15 '18 at 19:13







James

















asked Nov 14 '18 at 23:05









JamesJames

936




936












  • which authority did you use?

    – Jean-Marc Prieur
    Nov 15 '18 at 6:33











  • I added the authority above with a placeholder for our tenant id.

    – James
    Nov 15 '18 at 14:59











  • Do you want to try with login.microsoftonline.comtenant/v2.0 ?

    – Jean-Marc Prieur
    Nov 15 '18 at 19:05












  • I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

    – James
    Nov 15 '18 at 19:13

















  • which authority did you use?

    – Jean-Marc Prieur
    Nov 15 '18 at 6:33











  • I added the authority above with a placeholder for our tenant id.

    – James
    Nov 15 '18 at 14:59











  • Do you want to try with login.microsoftonline.comtenant/v2.0 ?

    – Jean-Marc Prieur
    Nov 15 '18 at 19:05












  • I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

    – James
    Nov 15 '18 at 19:13
















which authority did you use?

– Jean-Marc Prieur
Nov 15 '18 at 6:33





which authority did you use?

– Jean-Marc Prieur
Nov 15 '18 at 6:33













I added the authority above with a placeholder for our tenant id.

– James
Nov 15 '18 at 14:59





I added the authority above with a placeholder for our tenant id.

– James
Nov 15 '18 at 14:59













Do you want to try with login.microsoftonline.comtenant/v2.0 ?

– Jean-Marc Prieur
Nov 15 '18 at 19:05






Do you want to try with login.microsoftonline.comtenant/v2.0 ?

– Jean-Marc Prieur
Nov 15 '18 at 19:05














I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

– James
Nov 15 '18 at 19:13





I tried that and still get the same result. By the way I had to add IdentityModelEventSource.ShowPII = true; to the code to get the error to show why the signature validation was failing.

– James
Nov 15 '18 at 19:13












1 Answer
1






active

oldest

votes


















0














I opened a case with Microsoft and one of their developers helped discover that the problem was with OpenId and Enterprise applications. When I created a non-enterprise application (Web/API) I was able to get the web site to properly authenticate. I tested this by creating an enterprise app from scratch and comparing the browser behavior between the Web/API app and the Enterprise app. The problem only shows up for the enterprise app. I'm not sure what the difference is, but it is on Microsoft's side. Also, it only shows up for OpenId. I was able to get it working with SAML as I mentioned above. I'm not clear on what the distinction is between the Web/API app and the Enterprise app.






share|improve this answer






















    Your Answer






    StackExchange.ifUsing("editor", function ()
    StackExchange.using("externalEditor", function ()
    StackExchange.using("snippets", function ()
    StackExchange.snippets.init();
    );
    );
    , "code-snippets");

    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "1"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













    draft saved

    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53310057%2fasp-net-azure-openid-integration%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    0














    I opened a case with Microsoft and one of their developers helped discover that the problem was with OpenId and Enterprise applications. When I created a non-enterprise application (Web/API) I was able to get the web site to properly authenticate. I tested this by creating an enterprise app from scratch and comparing the browser behavior between the Web/API app and the Enterprise app. The problem only shows up for the enterprise app. I'm not sure what the difference is, but it is on Microsoft's side. Also, it only shows up for OpenId. I was able to get it working with SAML as I mentioned above. I'm not clear on what the distinction is between the Web/API app and the Enterprise app.






    share|improve this answer



























      0














      I opened a case with Microsoft and one of their developers helped discover that the problem was with OpenId and Enterprise applications. When I created a non-enterprise application (Web/API) I was able to get the web site to properly authenticate. I tested this by creating an enterprise app from scratch and comparing the browser behavior between the Web/API app and the Enterprise app. The problem only shows up for the enterprise app. I'm not sure what the difference is, but it is on Microsoft's side. Also, it only shows up for OpenId. I was able to get it working with SAML as I mentioned above. I'm not clear on what the distinction is between the Web/API app and the Enterprise app.






      share|improve this answer

























        0












        0








        0







        I opened a case with Microsoft and one of their developers helped discover that the problem was with OpenId and Enterprise applications. When I created a non-enterprise application (Web/API) I was able to get the web site to properly authenticate. I tested this by creating an enterprise app from scratch and comparing the browser behavior between the Web/API app and the Enterprise app. The problem only shows up for the enterprise app. I'm not sure what the difference is, but it is on Microsoft's side. Also, it only shows up for OpenId. I was able to get it working with SAML as I mentioned above. I'm not clear on what the distinction is between the Web/API app and the Enterprise app.






        share|improve this answer













        I opened a case with Microsoft and one of their developers helped discover that the problem was with OpenId and Enterprise applications. When I created a non-enterprise application (Web/API) I was able to get the web site to properly authenticate. I tested this by creating an enterprise app from scratch and comparing the browser behavior between the Web/API app and the Enterprise app. The problem only shows up for the enterprise app. I'm not sure what the difference is, but it is on Microsoft's side. Also, it only shows up for OpenId. I was able to get it working with SAML as I mentioned above. I'm not clear on what the distinction is between the Web/API app and the Enterprise app.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Nov 26 '18 at 21:52









        JamesJames

        936




        936





























            draft saved

            draft discarded
















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid


            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.

            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53310057%2fasp-net-azure-openid-integration%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            這個網誌中的熱門文章

            How to read a connectionString WITH PROVIDER in .NET Core?

            Node.js Script on GitHub Pages or Amazon S3

            Museum of Modern and Contemporary Art of Trento and Rovereto