Implementing an OAuth client credentials flow with ADFS–Part 4–Understanding and fixing returned error codes
It looked like most of the world has made the switch to Microsoft Entra(Azure Active Directory). However one of my clients is still using ADFS. Unfortunately there isn't much information left on how to get an OAuth flow up and running in ADFS. Most of the links I found point to documentation that no longer exists. So therefore this short blog series to show you end-to-end how to get an OAuth Client Credentials flow configured in ADFS.
Part 2 – Application configuration
Part 4 (this post) – Understanding and fixing returned error codes
Last post we updated our configuration so we could see any errors returned and are able to debug the authentication flow. In the first 2 posts I showed you everything that was needed to get up and running. The reality was that it took some trial and error to get everything up and running.
In this post I share all the errors I got along the way and how I fixed them.
IDX10204: Unable to validate issuer
It all started with the following error message:
IDX10204: Unable to validate issuer. validationParameters.ValidIssuer is null or whitespace AND validationParameters.ValidIssuers is null or empty.
In my case the issue was causes by specifying the wrong ADFS URL.
I was using:
options.Authority = "https://<servername>/adfs/oauth";
Instead of:
options.Authority = "https://servername/adfs";
IDX10214: Audience validation failed
After fixing the first error message, I was immediately welcomed by a second error:
IDX10214: Audience validation failed. Audiences: 'urn:microsoft:userinfo'
A search on the Internet brought me to the ADFS documentation, where I found the following:
AD FS identifies the resource that the client wants to access through the resource parameter that's passed in the authentication request. If you use the MSAL client library, the resource parameter isn't sent. Instead, the resource URL is sent as a part of the scope parameter: scope = [resource url]/[scope values, for example, openid].
If the resource isn't passed using the resource or scope parameters, AD FS uses a default resource urn:microsoft:userinfo whose policies, such as, MFA, issuance, or authorization policy, can't be configured.
I originally passed the scope like this:
// Replace these with your OAuth server details
string tokenEndpoint = "https://<servername>/adfs/oauth2/token";
string clientId = "<client id>";
string clientSecret = "<client secret>";
string scope = "readdata";
string apiEndpoint = "https://localhost:7002/weatherforecast/";
var client = new HttpClient();
// Obtain the token
var tokenResponse = await client.PostAsync(tokenEndpoint, new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("client_id", clientId),
new KeyValuePair<string, string>("client_secret", clientSecret),
new KeyValuePair<string, string>("grant_type", "client_credentials"),
new KeyValuePair<string, string>("scope", scope)
}));
Instead I had to prefix the scope with the resource as specified in the documentation:
// Replace these with your OAuth server details
string tokenEndpoint = "https://<servername>/adfs/oauth2/token";
string clientId = "<client id>";
string clientSecret = "<client secret>";
string scope = "https://localhost/exampleapi/readdata";
string apiEndpoint = "https://localhost:7002/weatherforecast/";
var client = new HttpClient();
// Obtain the token
var tokenResponse = await client.PostAsync(tokenEndpoint, new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("client_id", clientId),
new KeyValuePair<string, string>("client_secret", clientSecret),
new KeyValuePair<string, string>("grant_type", "client_credentials"),
new KeyValuePair<string, string>("scope", scope)
}));
An alternative solution is to pass the resource parameter as well and leave the scope ‘as-is’:
// Replace these with your OAuth server details
string tokenEndpoint = "https://<servername>/adfs/oauth2/token";
string clientId = "<client id>";
string clientSecret = "<client secret>";
string scope = "readdata";
string resource= "https://localhost/exampleapi";
string apiEndpoint = "https://localhost:7002/weatherforecast/";
var client = new HttpClient();
// Obtain the token
var tokenResponse = await client.PostAsync(tokenEndpoint, new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("client_id", clientId),
new KeyValuePair<string, string>("client_secret", clientSecret),
new KeyValuePair<string, string>("grant_type", "client_credentials"),
new KeyValuePair<string, string>("scope", scope),
new KeyValuePair<string, string>("resource", resource)
}));
IDX10205: Issuer validation failed
Not there yet! The next error I got was the following one:
IDX10205: Issuer validation failed. Issuer: 'https://<servername>/adfs/services/trust'. Did not match: validationParameters.ValidIssuer: 'null' or validationParameters.ValidIssuers: 'null' or validationParameters.ConfigurationManager.CurrentConfiguration.Issuer: 'https://<servername>/adfs'. For more details, see https://aka.ms/IdentityModel/issuer-validation.
To fix this error I had to do 2 things, first check that the MetadataAddress was set correctly:
options.MetadataAddress = "https://<servername>/adfs/.well-known/openid-configuration";
Second I had to explicitly specify one or more ValidIssuers:
options.Authority = "https://<servername>/adfs"; //Replace with your OAuth server URL
options.Audience = "https://localhost/exampleapi"; // Replace with your API audience
options.TokenValidationParameters.ValidIssuer = “/adfs/services/trust">http://<servername>/adfs/services/trust”;
HTTP 400 response from ADFS
A last error I got that didn’t result in a specific authentication error but in an 400 response from ADFS was caused by having an invalid scope specified.
Here is the scope I was using:
string scope = "https://localhost/exampleapi/readdata";
The mistake I made is that I originally configured the identifier for the API with a trailing slash.
I was using the following URL:
After updating the URL to the following(notice that the trailing slash is gone), it finally worked:
More information
ValidatingTokens · AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet Wiki · GitHub