Azure 使用 Auth0 的应用服务 OpenID 身份验证失败：值不能是 null。 （参数'rawToken'）

Question

I'm creating an App Service in Azure and trying to wire up OpenID Connect authentication with Auth0.

Problem:

Auth0's login page pops up, I can login. Auth0 redirects browser to my app's callback URL with the Authorization Code. The app returns HTTP 500 internal server error.

...easyauth_docker.log shows that Azure Authentication Middleware thrown the following exception:

... System.ArgumentNullException: Value cannot be null. (Parameter 'rawToken') 2021-12-13T15:40:26.451788664Z at Microsoft.Azure.AppService.Middleware.ModuleUtils.ThrowIfNullOrEmpty(String argName, String argValue) in /EasyAuth/Microsoft.Azure.AppService.Middleware.Modules/ModuleUtils.cs:line 867 2021-12-13T15:40:26.451799664Z at Microsoft.Azure.AppService.Middleware.ModuleUtils.ValidateJwt(String siteName, String rawToken, TokenValidationParameters parameters, String provider, Boolean useLegacyClaims, JwtSecurityToken& jwt, Exception& handledException, Boolean isLoginAction) in /EasyAuth/Microsoft.Azure.AppService.Middleware.Modules/ModuleUtils.cs:line 567 System.ArgumentNullException: Value cannot be null. (Parameter 'rawToken') 2021-12-13T15:40:26.451788664Z at Microsoft.Azure.AppService.Middleware.ModuleUtils.ThrowIfNullOrEmpty(String argName, String argValue) in /EasyAuth/Microsoft.Azure.AppService.Middleware.Modules/ModuleUtils.cs:line 867 2021-12-13T15:40:26.451799664Z at Microsoft.Azure.AppService.Middleware.ModuleUtils.ValidateJwt(String siteName, String rawToken, TokenValidationParameters parameters, String provider, Boolean useLegacyClaims, JwtSecurityToken& jwt, Exception& handledException, Boolean isLoginAction) in /EasyAuth/Microsoft.Azure.AppService.Middleware.Modules/ModuleUtils.cs:line 567 ...

Implementation:

• Created App Service in Azure with Linux/Node.js. The app is available without authentication at: https://<MY_APP>.azurewebsites.net . I can debug it with VS Code too.
• Created an Auth0 Application of type Regular Web Application (Authorization Code Grant). Added Allowed Callback URL: https://<MY_APP>.azurewebsites.net/.auth/login/auth0/callback
• Enabled Authentication on App Service. Added OpenID Connect Identity Provider. Specified Metadata URL: https://<MY_AUTH0_DOMAIN>/.well-known/openid-configuration (URL works from browser). Copied Client ID and Client Secret from Auth0 page.

Additional info:

• Auth0's log contains two entries: Success Login and Successful Exchange: "Authorization Code for Access Token"
• After login page, the redirected call does not reach my node.js code (checked in debugger).

Answer 1

I was having exactly the same problem even though I was using Ory Hydra instead of Auth0 to authenticate. In my case, I realize my Authentication app wasn't sending the id_token back with the authorization_token . Checking the list of the Common Problems I found some referencing OpenID Connect ID Token missing .

In my case it was the 4th option, because I forgot to send the correct scopes in my consent app:

4. Your consent app didn't send granted_scope: ["openid"] or when accepting the consent request.

So, I believe that if your authentication app is not sending the id_token , Azure Authentication Middleware will throw the exact same error. Hope it helps someone with the same problem.

Answer 2

Please check if your cause is among few of known cases:

1. Try to restart your web app and check if that makes any difference.

2. According to Node.js best practices and troubleshooting- Azure App Service | Microsoft Docs

If your application is returning 500 Errors when it starts, there could be a few reasons:

1. Node.exe is not present at the correct location. Check nodeProcessCommandLine setting.
2. Main script file is not present at the correct location. Check web.config and make sure the name of the main script file in the handlers section matches the main script file.

It may also be due to incompatible nuget packages.

3. App services has a setting WEBSITE_AUTH_RUNTIME_VERSION . This can be a possible cause: Try to modify the runtime version of app service. See .net - Azure App Service - Stack Overflow .Then restart the process.

For Linux apps, add an app setting called WEBSITE_WEBDEPLOY_USE_SCM and set it to true in your app: Reference

In some cases where not necessary,removing docker connector will solve the issues related to null reference exceptions.

References:

1. node.js - similar type of error - Stack Overflow

2. Azure Functions and App Service Authentication with Auth0 and other OpenID Connect providers (anthonychu.ca)

You can raise a support request if issue remains: from overview page of azure app service portal > Support + troubleshoot > New Support Request.