I'm trying to get a response containing the code for (future) exchange for a token. WHen I execute the following call in Postman:
GET https://localhost:7101/connect/authorize
?client_id=tyr-idp
&scope=oidc profile openid
&response_type=code
&redirect_uri=https://localhost:7101/spa
I get a hit in the method below. I'm adding a state for future recognition of the requester and redirect the call to the (currently very mocked GUI) based on the specified values.
[HttpGet("login")]
public async Task<IActionResult> Login([FromQuery] string returnUrl)
{
string state = "S1337";
string redirectUri = returnUrl.Query("redirect_uri");
redirectUri = HttpUtility.UrlDecode(redirectUri);
string url = redirectUri
+ $"?state={state}&returnUrl=" + HttpUtility.UrlEncode(returnUrl);
return Redirect(url);
}
This succeeds and I arrive in the "GUI" where user "enters" the credentials. When that is done, I try to execute a request by redirection to the callback
part of the authorize
endpoint.
[HttpGet("/spa")]
public async Task<IActionResult> FakeSpa(
[FromQuery] string returnUrl, [FromQuery] string state)
{
string name = "user1234";
string pass = "pass1234";
string url = returnUrl + $"&state={state}&name={name}&pass={pass}";
return Redirect(url);
}
The above fails. I'm not arriving in the error
endpoint. Instead, I land back into login endpoint and the returnUrl
gets amendment of the new retry.
[HttpGet("error")]
public async Task<IActionResult> Error([FromQuery] string errorId)
{
ErrorMessage? errContext = await Interaction.GetErrorContextAsync(errorId);
return BadRequest(errContext);
}
I'm suspecting that I'm redirecting wrongly. I was assuming that I'd get a repsonse in Postman containign the code (or, at least, a call to another endpoint where I can validate the credentials and sign in the identity). As far I recall when I did something like this a while ago, the signing in, isn't supposed to be done within the same method as the initial login lands into. Am I remembering poorly?
HttpContext.SignIn(user)
has been invoked. (I.e. it's actually that specific.) I'm about to see the issue I'm hitting. The code works, apparently, if I run it without breakpoints. For some reason, when I have breakpoints, I get something about SSO being excided. Never seen that before and it's so weird that the breakies would cause it.