Asp.Net Core Api Authorization

Question

I have an Asp.Net Core / ReactJs aopplication. I'm using Microsoft.AspNetCore.ApiAuthorization.IdentityServer to authenticate the API. However, I'm getting an error, which I believe is down to bad configuration.

If I run this locally, with the following config, everything works, and the app redirects to the log-in screen as expected:

  "IdentityServer": {
    "Clients": {
      "MyApp": {
        "Profile": "IdentityServerSPA",        
      }
    },
    "Key": {
      "Type": "File",
      "FilePath": "Assets/selfsignedcert.pfx",
      "Password": "password"
    }
  },

However, if I change the config to the following:

  "IdentityServer": {
    "Clients": {
      "MyApp": {
        "Profile": "IdentityServerSPA",        
        "RedirectUri": "https://localhost:5211/authentication/login-callback"
        "LogoutUri": "https://localhost:5211/authentication/logout-callback"        
      }
    },
    "Key": {
      "Type": "File",
      "FilePath": "Assets/selfsignedcert.pfx",
      "Password": "password"
    }
  },

It errors (redirecting to the following):

https://localhost:5211/home/error?errorId=1234...

Looking at the auth request, from the client, they are exactly the same; however the second returns an error, while the first successfully redirects.

Is there something wrong with my config? Alternatively, how can I debug this issue?

Answer 1

Both of your Uris in the non-working configuration point to logout. Is this really what you're trying to do?

In the first configuration, you're not defining any Uris, so they will have the following default values:

The redirect_uri defaults to /authentication/login-callback. The post_logout_redirect_uri defaults to /authentication/logout-callback.

As documented here

Try changing the second configuration to match the default values to see if that helps.

Answer 2

The client configuration of redirect_uri and post_logout_redirect_uri must be identical to the IDP:

redirect_uri: 'https://localhost:5211/authentication/login-callback',
post_logout_redirect_uri: 'https://localhost:5211/authentication/logout-callback',

Or

redirect_uri: $'{IDPhost_config}/authentication/login-callback',
post_logout_redirect_uri: $'{IDPhost_config}/authentication/logout-callback',