0

I'm trying to get a response containing the code for (future) exchange for a token. WHen I execute the following call in Postman:

GET https://localhost:7101/connect/authorize
?client_id=tyr-idp
&scope=oidc profile openid
&response_type=code
&redirect_uri=https://localhost:7101/spa

I get a hit in the method below. I'm adding a state for future recognition of the requester and redirect the call to the (currently very mocked GUI) based on the specified values.

[HttpGet("login")]
public async Task<IActionResult> Login([FromQuery] string returnUrl)
{
  string state = "S1337";
  string redirectUri = returnUrl.Query("redirect_uri");
  redirectUri = HttpUtility.UrlDecode(redirectUri);
  string url = redirectUri 
    + $"?state={state}&returnUrl=" + HttpUtility.UrlEncode(returnUrl);
  return Redirect(url);
}

This succeeds and I arrive in the "GUI" where user "enters" the credentials. When that is done, I try to execute a request by redirection to the callback part of the authorize endpoint.

[HttpGet("/spa")]
public async Task<IActionResult> FakeSpa(
  [FromQuery] string returnUrl, [FromQuery] string state)
{
  string name = "user1234";
  string pass = "pass1234";
  string url = returnUrl + $"&state={state}&name={name}&pass={pass}";

  return Redirect(url);
}

The above fails. I'm not arriving in the error endpoint. Instead, I land back into login endpoint and the returnUrl gets amendment of the new retry.

[HttpGet("error")]
public async Task<IActionResult> Error([FromQuery] string errorId)
{
  ErrorMessage? errContext = await Interaction.GetErrorContextAsync(errorId);
  return BadRequest(errContext);
}

I'm suspecting that I'm redirecting wrongly. I was assuming that I'd get a repsonse in Postman containign the code (or, at least, a call to another endpoint where I can validate the credentials and sign in the identity). As far I recall when I did something like this a while ago, the signing in, isn't supposed to be done within the same method as the initial login lands into. Am I remembering poorly?

2
  • What is your main objective? Are you trying to get a user level access token for testing APIs, or do you want to test user logins? Sep 19 at 17:20
  • @GaryArcher The main objective as in apart from this particular question? That's a regular login using Auth Code Flow. We have that working already. The specific task here is to create a demo showing that the code is being returned to the requester after the HttpContext.SignIn(user) has been invoked. (I.e. it's actually that specific.) I'm about to see the issue I'm hitting. The code works, apparently, if I run it without breakpoints. For some reason, when I have breakpoints, I get something about SSO being excided. Never seen that before and it's so weird that the breakies would cause it. Sep 20 at 18:46

1 Answer 1

0

You're not actually authenticating the user.

You can't just pass the username and password as query parameters. That's not how the Authorization Code flow (indicated by your use of response_type=code) works and is actually more similar to the Resource Owner Password Credentials flow.

At a high-level, the user enters their credentials and is authenticated. Now, you can mock the entering of the credentials, but the authentication server still needs to verify the user in some way to generate a valid authorisation code.

Once the user has been successfully authenticated, it'll then redirect back to the client application (the redirect_uri you specified in the initial request) with the code. The application then exchanges the auth code for tokens at the token endpoint provided by the IdP (identity provider).

You need to authenticate your user(s) in some way.

For development purposes, take a look at the interactive user authentication UI provided by Identity Server & the AddTestUsers method.

I highly recommend reading about the Authorization Code flow and the steps involved to complete this flow end-to-end.

5
  • I agree. The part that I get stuck on is that the authentication will be based on something that the user provides. We don't have an external authority in this scenario, so the combo of user/pass will be entered in some GUI in an external app. Then, at our backend, I'll check if the creds are correct and perform HttpContext.SignIn(recognizedUserIdentity). I don't recall how I actually did that last time, though. Do you do the signing-in in the Login? I remember that it wasn't done there. Sep 17 at 17:55
  • Or, to be more precise - where should I put the authentication portion? It must be after the user has entered the user/pass (which is mocked in the endpoint (pretend it's an external SPA). After they type in correct user/pass combo, where is that sent? It's to the connect/authorize/callback, right? Sep 17 at 17:57
  • 1
    There is also a new BearerToken handler in .NET 8 that simplifies the life for SPA developers , i blogged about it here nestenius.se/2023/08/29/… but it does not solve your general mocking question. The alternative is to use the client credentials flow for testing. Sep 18 at 5:56
  • @ToreNestenius I'll take a look. Haven't had chance to play with NET8 that much yet. As for the question above, client cred flow works great. Now, I'm on the next step, auth code flow, and it's specifically about obtaining that code (prior to exchange for a token) that I'm trying to work out. I'm unsure about is the part after the user provides credentials and backchannels to the authority - it's at that point that I can sign them in to the HTTP context. But Duende bumps that callback to my account/login endpoint anyways, which confuses me. Sep 19 at 7:17
  • I would use a tool like getfiddler.com to explore the low-level requests being made, as a way to determine exactly what request in the flow that fails. However, client cred flow is not really meant for users to login, its more for service-to-service communication. Sep 19 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.