3

Have an Asp.Net Core 2.2.1 Web Api that is trying to obtain OpenId Configuration so that it can authenticate a request. The authority web site happens to be IdentityServer4.

The /.well-known/openid-configuration looks correct and the api site is running and unsecure api methods work ok.

Viewing the logs in Kudu, I see the following error. Appears to be caused by a Sockets issue but I have no idea what's wrong here.

All works fine locally on my dev machine, so what am I missing / is needed for Azure?

System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden]'. ---> 
System.Net.Http.HttpRequestException: An attempt was made to access a socket
in a way forbidden by its access permissions --->

Full error detail;

2019-01-11 11:07:43.096 +00:00 [Error] Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler: Exception occurred while processing message.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden]'. ---> System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden]'. ---> System.Net.Http.HttpRequestException: An attempt was made to access a socket in a way forbidden by its access permissions ---> System.Net.Sockets.SocketException: An attempt was made to access a socket in a way forbidden by its access permissions
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.CreateConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.WaitForCreatedConnectionAsync(ValueTask`1 creationTask)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
richardb
  • 943
  • 1
  • 10
  • 27
  • Ok adding .UseAzureAppServices() to the WebHost builder seems to have fixed the sockets issue - not sure exactly what that does but now I'm just getting the error cannot obtain configuration info IDX20803: Unable to obtain configuration from: '[PII is hidden]'. So it seems to be struggling to find the /.well-known/openid-configuration url. How do I unhide the PII is hidden? The config looks to have correct uri' if I browse to it in Chrome, IE, etc. – richardb Jan 11 '19 at 16:37
  • Ok its picking up localhost when trying to find the well-known configuration. http://localhost:5010/.well-known/openid-configuration. – richardb Jan 14 '19 at 09:30

1 Answers1

6

After hours of debugging, and switching on 

IdentityModelEventSource.ShowPII = true;    //show detail of error and see problem

to see the problem with the well-known configuration I saw that it was not picking up application settings from the Azure portal.

As my settings were nested, I just needed to make sure the key in the Azure blade matched.

i.e.

{
  "AppSettings": {
    "ApiUrl": "someUrl",
    "AuthorityUrl": "anotherUrl"
  }, ...

becomes

AppSettings:ApiUrl

Simple mistake gotcha.

richardb
  • 943
  • 1
  • 10
  • 27