IdentityServer4 | AspNetCoreIdentityIdentityServer4 | Identity Management library

I finally resolved this issue. But still not satisfied with the methodology. Yet, it works gracefully. What I expected from OAuth2AuthorizationRequestResolver that the request to get the jwt token gets created internally and I should be unaware of the random string generated as code_challenge(to implement PKCE).

I still request to share if somebody has a working example of authenticating and getting token by just providing required confs without me implementing and overriding OAuth2AuthorizationRequestResolver. So, here i go

To implement OAuth2AuthorizationRequestResolver please follow https://developer.okta.com/blog/2020/01/23/pkce-oauth2-spring-boot

then in method addPkceParameters

I investigated this problem and found cause. I used IdentityModel V 4,2,2 before update. When I update my project to NET 6, IdentityModel was upgrated to version 5.2.0. The difference between IdentityModel V 4,2,2 and IdentityModel version 5.2.0 was in signature method.

There are no RFCs or standards which would say what information can end up in claims and which don't. I would try to stick to those guidelines:

1. Try to keep information in tokens as minimal as required. Don't put something in claims only because maybe one service will need it from time to time. Put only those claims which most of the service use all the time, or information which needs to be asserted by the Authorization Server. The other data usually belong to the microservices themselves or can be easily obtained through API calls. This is especially important if you're using JWTs publicly available on the Internet, as anyone can read those information.

2. Try not to put Personally Identifiable Information in a JWT, especially if the token is available publicly. When someone steals such a token they will be able to read your users' PII. If you need this kind of information in a token, then think of using the Phantom Token pattern. This way the information is safe from eavesdroppers.

3. By limiting the amount of claims in a token you can also limit the permissions of a token. It's better to have tokens with lower permissions and use token exchange whenever more information or privilege is needed.

4. Remember that the claims in the token are a contract between the Authorization Server and the consumer (usually the API). Once you add something to a token, you usually won't be able to remove it, as this will constitute a breaking change.

Have a look at these articles we wrote at Curity to get some more knowledge about dealing with claims and JWTs:

• Claims Best Practices
• JWT Security Best Practices

Initially please try by deleting history in the browser and use "login.microsoftonline.com//v2.0/" as authority string. And options.CallbackPath = "/signin-oidc"; options.ResponseType = "code id_token";

NOTE : The identity platform which is used by Microsoft has a character limit for links. This type of error will appear if the authorization request or link is longer than the said limit,.

Protocols like OpenID Connect, allow state as a parameter in the authorization request, and the identity provider will return that state in the response as you can find that in error page you provided . Because of which the request URL becomes large as sometimes the state parameter is long.(which might be the possible case here)

Try to call the AddOidcStateDataFormatterCache extension method on the IServiceCollection in startup class which uses the distributed cache in the backend like:

I managed to track down the cause and fix it.

1. Microsoft.AspNetCore.Authentication.JwtBearer actually makes not 1 but 2 calls to IdentityServer4: one to /.well-known/openid-configuration to get the configuration and then a call to the endpoint returned in jwks_uriof the previous response. The first call was to a localhost:port endpoint using the self signed certificate and working normally but the 2nd was to a realdomain endpoint using the Let's Encrypt certificate and failing with the error in the OP.
2. The Let's Encrypt certificate had an expired certificate in the chain: it was using DST Root CA X3 instead of ISRG Root X1 (more info here: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)

This can be achieved by changing the IdentityServer4 origin in Startup.cs:

Most providers supports the AT+JWT token type and in it is specified that it should include a scope claim:

• JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens

It says:

If an authorization request includes a scope parameter, the corresponding issued JWT access token MUST include a scope claim as defined in section 4.2 of [TokenExchange].

All the individual scopes strings in the scope claim MUST have meaning for the resource indicated in the aud claim.

Your application can query the IdentityServer UserInfo endpoint, perhaps every time he logs in (or changes his user profile?) and store the information in the local database.

The question is also how much "eventual consistency" you can accept between your application and your IDP?

One option is to enable this feature and when you change your user profile, you use your refresh token to get a new access token.

One way could be to use a tenant claim within each bearer token, so that when a user changes an organization on the portal (in case one user has access to several orgs), you perform relogin to the chosen tenant, or just request a new access token with a chosen tenant_id inside.

You can use this and this answers for the reference on how to pass a custom parameter (such as tenant id) with your request to Identityserver.

Alright, so when you have the following configuration: