5,716 questions
0
votes
0
answers
32
views
.NET 4.6 Owin application gets authenticated, but User.Identity.IsAuthenticated stays false
Last weekend, I deployed an old .NET 4.6 application with OpenId authentication to an IIS server without any problem. Two days later, the problem started that the authentication falls in a loop ...
- 647
0
votes
0
answers
31
views
Can the aud claim in mod_auth_openidc token revocation be reconfigured?
My app triggers an OIDC logout by directing the user to mod_auth_openidc's OIDCRedirectURI. mod_auth_openidc then sends the OIDC Provider (OP) a request to revoke the access token. The OP determines ...
- 1
0
votes
1
answer
48
views
With OpenID Connect, how to force the end-user to re-authenticate?
I'm currently implementing a stateless OpenID Connect Relying Party, and would like to invalidate the End-User session whenever something suspect is detected, by forcing them to reauthenticate.
Given ...
- 6,836
0
votes
1
answer
51
views
Owin security could not handle callback "signin-oidc", Error 404 on ASP.NET MVC
I have a simple ASP.NET MVC app with .NET 4.8.
I want to use keycloak as security management and my app connect to it via openid connect protocol.
To do this, I've created a startup.cs class in my ...
- 95
0
votes
1
answer
40
views
Azure AD B2C: invalid_grant with JWE key missing when redirecting via SSO pre-login app
[ERR] Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler
Message contains error: 'invalid_grant',
error_description: 'AADB2C90090: The specified kid 'cpimcore_09252015' is not ...
1
vote
1
answer
44
views
Logging out from a blazor app and also at the authority
I've got a Blazor app set up with an external oidc authority
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
...
- 3,092
0
votes
0
answers
36
views
Redirect issue with Identity Provider hosted in Docker
TLDR:Dockerised app redirects me to docker network URL instead of localhost.
Objective: Redirect user to identity provider (localhost:6067) while communicating with it at (mcro.identity) from Razor ...
- 93
0
votes
0
answers
29
views
Does Spring Authorization supports FAPI 2.0
I'm trying to do a PoC on FAPI 2.0 for which I want to have an authorization server that supports FAPI2.0 along with the control over IDP integration, user database, OIDC provider and onboarding third ...
- 4,008
0
votes
1
answer
81
views
keycloak jwks_uri inconsistent response
all, thanks in advance for any help. This is a copy of a question I asked at the Keycloak community forum that, unfortunately, got no responses.
Hi, all. Thanks in advance for any help.
I’m setting ...
- 332
2
votes
2
answers
137
views
Is asking the UserInfo endpoint for claims required to be standard compliant with OIDC?
I've implemented OIDC support in an application, and I ran into a situation where my implementation didn't work for a specific authentication provider. Specifically Shibboleth with an OIDC plugin.
...
- 649
0
votes
1
answer
67
views
Token Exchange to edit existing custom claims
I want to add a new functionality to a webapp and for that functionality, I want to edit an existing claim in my JWT when the user that interacts with the client chooses to use this feature. Now, ...
- 985
0
votes
0
answers
37
views
How do i configure apisix openid-connect plugin for PKCE (native client) and client id/secret flow (web apps)
I am able to configure the apisix openid-connect plugin for either the PKCE flow native apps "use_pkce": true or the web application flow "use_pkce": false.
When using PKCE, the ...
- 857
0
votes
1
answer
45
views
Angular Apps Using Same IdentityServer – Silent Refresh Fails When Redirecting Between Two Apps
I have two independent Angular applications (url1 and url2), both hosted on Azure Kubernetes Service (AKS) and configured to use the same IdentityServer (OIDC-based) for authentication.
Application ...
2
votes
0
answers
57
views
Injected `JsonWebToken` Is Null When Using Both OIDC and JWT Authentication Mechanisms in Quarkus
I'm working on a Quarkus 3.24 application that supports two types of authentication:
Users authenticated via OIDC (Keycloak), using the standard authorization code flow.
Clients (agents or devices) ...
- 679
0
votes
1
answer
85
views
Public clients should not validate ID tokens
I noticed that when using OIDC (hybrid or implicit flow) with Azure Identity, the Authorization Code with PKCE is only used for access tokens, not id tokens.
An id token is directly returned in the ...
- 1,511