.Net Core 2.0 - OpenID Connect - invalid Discovery Document

Question

i'm using a specific OIDC provider for my security in .Net Core 2.0 MVC Project, however I am having trouble with the Discovery Document.

I have been given 3 url's from the provider (where the domain is fiction):

https://www.oidcprovider.com/connectapi/authorize

https://www.oidcprovider.com/connectapi/token

https://www.oidcprovider.com/connectapi/userinfo

in my configuration, i have entered the following values:

 .AddOpenIdConnect(options => {
                    options.Authority = "https://www.oidcprovider.com/connectapi/authorize/";
                    options.ClientId = "xxx";
                    options.ClientSecret = "xxx";
                    options.ResponseType = OpenIdConnectResponseType.Code;
                    options.CallbackPath = new PathString("/api/security/callback");

I am getting the following error, trying to run the application:

An unhandled exception occurred while processing the request. HttpRequestException: Response status code does not indicate success: 400 (Bad Request). System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()

IOException: IDX10804: Unable to retrieve document from: 'https://www.oidcprovider.com/connectapi/authorize/.well-known/openid-configuration'. Microsoft.IdentityModel.Protocols.HttpDocumentRetriever+d__8.MoveNext()

InvalidOperationException: IDX10803: Unable to obtain configuration from: 'https://www.oidcprovider.com/connectapi/authorize/.well-known/openid-configuration'. Microsoft.IdentityModel.Protocols.ConfigurationManager+d__24.MoveNext()

Is the OIDC Discovery Document required for this to work?

I have tried calling the discovery document URL directly in my browser, by calling this url: https://www.oidcprovider.com/connectapi/authorize/.well-known/openid-configuration

However, I receive this JSON information back:

{"error":"invalid_client","error_description":"No client id supplied"}

How do I get this to work?

My 2 Questions are:

1. Is the Discovery Document Optional or Mandatory ?

2. Can I specify the endpoints manually in .net Core 2.0 when no disco doc is available?

Have you tried to put different url into options.Authority? The oidcprovider.com/connectapi/authorize is most likely wrong. Try using either oidcprovider.com/connectapi or oidcprovider.com — Tomas
According to the spec (openid.net/specs/…) this shold be at the root of the Hostname: GET /.well-known/openid-configuration HTTP/1.1 Host: example.com — jwilleke
Thomas - it seems the discovery document is not available at the url's you suggested, only at the /authorize url. But giving me back the JSON Error. — Pinpoint Solutions
jwilleke - So, you are saying, that this Provider has not implemented the OpenID Connect protocol properly? — Pinpoint Solutions

Pinpoint Solutions Pinpoint Solutions · Accepted Answer · 2018-03-14T09:46:51

Seems like I have found my answers.

The discovery document is Optional.
Yes - you can by specifying the Configuration options in the .AddOpenIdConnect options

options.Configuration = new OpenIdConnectConfiguration() { AuthorizationEndpoint = "https://www.oidcprovider.com/connectapi/authorize", TokenEndpoint = "https://www.oidcprovider.com/connectapi/token", UserInfoEndpoint = "https://www.oidcprovider.com/connectapi/userinfo" };

.Net Core 2.0 - OpenID Connect - invalid Discovery Document

1 Answers