尝试使用来自 .NET 核心 Web 应用程序的 OpenIDConnect 进行身份验证时无效 scope

Question

So I am having an rather unusual issue when trying to setup OpenIDConnect inside a .NET Core App for authentication.

I have ran a test using Okta and everything was working fine but then when switching the details to au.neticate using a different service I am getting the following error.

OpenIdConnectProtocolException: Message contains error: 'invalid_scope', error_description: 'The requested scope is invalid, unknown, malformed, or exceeds that which the client is permitted to request.', error_uri: 'error_uri is null'.

Everything looks to be set correctly in the Program.cs file with the following

.AddOpenIdConnect(o =>
{
    o.SignInScheme = "Cookies";
    o.ClientId = config.GetSection("SsoConfig:ClientId").Value;
    o.ClientSecret = config.GetSection("SsoConfig:ClientSecret").Value;
    o.Authority = config.GetSection("SsoConfig:Authority").Value;
    o.SignedOutRedirectUri = config.GetSection("SsoConfig:SignedOutRedirectUri").Value;
    o.ResponseType = "code";
    o.Scope.Add("openid");
    o.Scope.Add("profile")
}

Any ideas what might cause this error? From what I can see everything is setup correctly and when using Okta it works but the other provider we are switching to it is failing with the above error. It is a 3rd party service used by a client that we have having to connect to so we have provided the same details I entered on Okta so I know they should work.

Maybe I have missed something obvious but the documentation shows the above as the way to do it.

For reference it is a .NET 6 Core Web App and the library I am using is Microsoft.AspNetCore.Authentication.OpenIdConnect (6.0.9)

Many thanks.

Answer 1

Although, I am very late to answer this, but I also faced the same issue today while authenticating with AWS Cognito.

I found that AddOpenIdConnect method adds 2 two scopes by default - openid & profile , and that creates the problem.

As a solution, I just cleared the default scopes and added the required ones manually.

.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme , options =>
{
    .
    .
    .
    options.Scope.Clear();
    options.Scope.Add("openid");
    options.Scope.Add("email");
    options.Scope.Add("phone");
});