IdentityServer Authentication Endpoint -> error=invalid_request failureReason=“STATUS_CODE”

Question

I am currently implementing SSO for one third-side service. The service doesn't support OIDC or OAuth, so I need to implement it proprietary. What I have is middleware, which handles requests. When it reckognizes request as login request from third side app, it creates authorize link and redirects it to [identityserver]/connect/authorize, which is authorize endpoint. Then server should give me back jwt token, which I would process. Anyway identity server gives me error and when I look into log file I can see failureReason="STATUS_CODE". But Response.Redirect() sets status code 302, which should be just fine, shouldn't be?

Client is set up just fine. I am using Implicit flow. However for AuthorizationCode or ClientCredentials sends me to error page with message: The client application is not known or is not authorized. Status code 204.

Middleware snippet:

            string url = $"{context.Request.Scheme}://{context.Request.Host}";
            DiscoveryClient discoveryClient = new DiscoveryClient("https://localhost:44300/");
            DiscoveryResponse doc = await discoveryClient.GetAsync();

            AuthorizeRequest authorizeRequest = new AuthorizeRequest(doc.AuthorizeEndpoint);
            string authorizeUrl = authorizeRequest.CreateAuthorizeUrl(
                clientId: "zendesk",
                responseType: "id_token token",
                scope: "openid email profile",
                redirectUri: $"{url}/zendesk/authenticated",
                state: Base64Url.Encode(returnTo.ToBytes()));

            context.Response.Redirect(authorizeUrl);

            return;

Redirected link:

https://localhost:44300/connect/authorize?client_id=zendesk&response_type=id_token+token&scope=openid+email+profile&redirect_uri=https%3A%2F%2Flocalhost%3A44327%2Fzendesk%2Fauthenticated&state=[64encodedValue]

Result link:

https://localhost:44327/zendesk/authenticated#error=invalid_request&state=[64encodedValue]

Thanks for any hint, I am in dead end here.

Qerts Qerts · Accepted Answer · 2016-11-10T12:26:45

I got another log which contained helpful message:

Nonce required for implicit and hybrid flow with openid scope
{
...
,
"SubjectId": "unknown",
"ResponseType": "id_token token",
"ResponseMode": "form_post",
"Flow": "Implicit",
"RequestedScopes": "openid email profile",
"State": "...",
"Raw": {
"client_id": "...",
"response_type": "id_token token",
"scope": "openid email profile",
"redirect_uri": "...",
"state": "...",
"response_mode": "form_post"
}

And I decided to use other flow anyway.

IdentityServer Authentication Endpoint -> error=invalid_request failureReason=“STATUS_CODE”

2 Answers