OpenID authentication via Azure fails

If your web portal uses an application server connection, you should find the log messages in the AppServer logs.

In regards to the error, the only thing I can think of is to check the settings in Azure AD to see if Azure AD is configured to not send the ID token in the implicit grant flow.

Hi Markus,

I also checked inside the application server logs inside this folder C:\inetpub\wwwroot\AppServer\App_Data\Logs but there are no new logs generated regarding the openID sign-in trial.

Should I check in another folder or enable an additional logging mode?

Moreover, the azure AD is configured to send an ID token as expected for the implicit and hybrid flows.

And I forgot, the Log must be configured to the Debug level to see more information.

Is the error message coming from within the Identity Manager web portal - "We couldn't sign you in. Please try again" or are we still in the Azure IDP portal when this error is presented?

So you mean you have seen somewhere that the flag for feeding back the ID token should be disabled in Azure side, have I understood it correctly?

Hi Tom, the error is on IDP portal still not on the web application side.

Yes, this is what I meant. But I haven't tested it personally.

Tried that as well, no progress.
I've also enabled the DEBUG mode and now I see this line:
Forcing session end on g2y3unzo0fkmf3pdtr45gwiv due to an invalid anti-session-fixation cookie value, redirecting to /UserIDPortal/page.axd?wproj=0 

Could that be related to the root cause or otherwise?
To be honest, this information is with label INFO but possibly I did not see it before..

Please try to set the httpCookies section in the web.config of the Web Portal to something like this. If this is not helping, try to set it on the Application Server web.config as well.

Hi Markus, I have updated the webconfig with this line
<httpCookies requireSSL="true" sameSite="Lax" />
and it actually moved forward but the login itself did not work.

Now instead of seeing the IDP portal, we see the ITShop login page with an error mentioning:
The authentication process could not be completed. Contact you system admin if issue persists.

An error occurred while processing your request. Check the application log files or contact the administrator yada yada.

Inside the log file I see this error:
Certificate: Using JWK endpoint configured in the identity provider.
2023-04-19 09:46:46.2350 ERROR ( ObjectLog haei4mqhhuuw1fc4xhlwhi1v) : Failed to authenticate user using OAuth2/Open ID Connect. System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).

404 means that the resource is not found inside the web server but the configuration is as below:

In designer the redirect URL is:
https://<servername>/UserIDPortal

In Azure, the redirect URL is:

https://<servername>/UserIDPortal/page.axd

Otherwise, it says that it cannot found the requested resource ending in page.axd

We've also tried with redirect URL in designer having this value:
https://<servername>/UserIDPortal/page.axd but it ends up asking for resource https://<servername>/UserIDPortal/page.axd/page.axd

Any more ideas?

Try this one.

In Azure the redirect URI should be https://<servername>/UserIDPortal/page.axd

In the Designer the redirect URI should be https://<servername>/UserIDPortal/

Please check the web.config of the Web Portal as well. It should contain the BaseURL when I am remebering it correctly.

What we have tried so far:

Designer redirect URL:

https://<serverName>/UserIDPortal/ (previous attempt without the ending slash /)

Azure redirect URL:

https://<servername>/UserIDPortal/page.axd

BaseURL in webconfig file:

https://<servername>/UserIDPortal/ (the server name here is in capital letters, but shouldn't make any difference, I suppose(?))

URL in navigation bar when we see the login page of the ITShop having an error:

https://<serverName>/UserIDPortal/page.axd?RuntimeFormID=e164085d-b854-47d3-a69c-22a5bf9dbe37&aeweb_handler=p&aeweb_rp=&wproj=0&ContextID=VI_Session

Error in log file of web application:

Failed to authenticate user. ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).

Error in Azure sign-in:
User needs to perform multi-factor authentication one identity.

But the thing is, user is already providing a 2FA code before submitting the request, he done it in front of me every single time.

In IIS, inside authentication we have both enabled Anonymous and Windows (again, I guess that does not have any impact but for the sake of it), the rest are disabled.

In OneIM level, user trying to log in has an active identity inside the DB with 6 AERoles assigned to him.

Plus one enabled AD user account fully managed linked to the identity, of course.

Last thing, on application server level, QBMWebApplication, I have NOT enabled the OAuth 2.0/OpenID Connect application condfiguration.

I've done this only on the webDesigner entry which is the web portal itself. I've found somewhere that you have to do this only on web app level and not on the app one, but just to be sure if it matters or not.

What we have tried so far:

Designer redirect URL:

https://<serverName>/UserIDPortal/ (previous attempt without the ending slash /)

Azure redirect URL:

https://<servername>/UserIDPortal/page.axd

BaseURL in webconfig file:

https://<servername>/UserIDPortal/ (the server name here is in capital letters, but shouldn't make any difference, I suppose(?))

URL in navigation bar when we see the login page of the ITShop having an error:

https://<serverName>/UserIDPortal/page.axd?RuntimeFormID=e164085d-b854-47d3-a69c-22a5bf9dbe37&aeweb_handler=p&aeweb_rp=&wproj=0&ContextID=VI_Session

Error in log file of web application:

Failed to authenticate user. ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).

Error in Azure sign-in:
User needs to perform multi-factor authentication one identity.

But the thing is, user is already providing a 2FA code before submitting the request, he done it in front of me every single time.

In IIS, inside authentication we have both enabled Anonymous and Windows (again, I guess that does not have any impact but for the sake of it), the rest are disabled.

In OneIM level, user trying to log in has an active identity inside the DB with 6 AERoles assigned to him.

Plus one enabled AD user account fully managed linked to the identity, of course.

Last thing, on application server level, QBMWebApplication, I have NOT enabled the OAuth 2.0/OpenID Connect application condfiguration.

I've done this only on the webDesigner entry which is the web portal itself. I've found somewhere that you have to do this only on web app level and not on the app one, but just to be sure if it matters or not.

My settings which work but I am not using 2fa, I will set that on my Azure tenant and test.

In Azure:

Redirect URI: servername.domain.com/.../page.axd

The two check boxes under Implicit grant and hybrid flows are unchecked

In Designer under Base Data\Security settings\OAuth 2.0/OpenID Connect configuration\Identity providers:

Under the Applications tab

Redirect URI: https://servername.domain.com/identitymanager/

Authentication method: client_secret_basic

Under Base Data\Security settings\Web server configurations\WebDesigner

Primary auth OAuth 2.0/OpenID Connect (role-based)

OAuth 2.0/OpenID Connect application: my application that I configured from Base Data\Security settings\OAuth 2.0/OpenID Connect configuration\Identity providers Applications tab

The above settings work for me.

I setup 2FA for one test user by using the Microsoft Authenticator application. Confirmed that I can log in to my Identity Manager web designer portal with this enabled as well.

Hi Troy,

These is exactly my configuration as well.

I am afraid the issue is on IDP level and not on OneIM level.
Do you have any other specifics for the IDP configuration, like mandatory configuration needed otherwise it does not work?

sorry that should be:

In Azure:

Redirect URI: servername.domain.com/.../page.axd

No I do not have any mandatory configuration set in the IDP or anywhere else.

No problem, I've already use that one.