Duende IdentityServer error: using 2 issuers and invalid token issue

Question

Problem starts by getting many errors like this in my logs:

 {
    "@mt": "Your license for Duende IdentityServer only permits {issuerLimit} number of issuers.
            You have processed requests for {issuerCount}. The issuers used were: {issuers}.",
    "@l": "Error",
    "issuerLimit": 1,
    "issuerCount": 2,
    "issuers": [
      "https://www.example.org",
      "https://example.org"
    ],
    "SourceContext": "Duende.IdentityServer",
    "RequestPath": "/connect/checksession"
  },

I am using default MS template for Hosted Blazor WebAssembly with Individual accounts. I did not set any issuer explicitly because I have test.mydomain.org and it seemed convenient.

I have DNS CNAME www.example.org to example.org, and in IIS I have one site example.org with 4 bindings: http and https for www and non www versions.

When everything work normally, no matter how I try to open my site using www or non www version, in incognito mode, logged in or logged out, no matter what I try I cannot intentionally get this error in log.

But then it starts to appear and it is noticed by user who can log in normally, but trying to access any API endpoint requiring authorization returns Bearer error="invalid_token", error_description="The issuer 'https://example.com' is invalid" (How to debug only occasional Bearer error="invalid_token").

I wonder how is it even possible to receive request from www.mydomain.org to IdentityServer if I cant do it by manually requesting www version? Where does the IdentityServer get these issuers from? And, does Identity server starts throwing these error on purpose after some time?

score 0 · Answer 1 · answered Jul 11 '23 at 13:16

By default the IssuerURI is based on the host that the request is received on. For example, https://www.example.org/.well-known/openid-configuration would show the issuer as https://www.example.org while https://example.org/.well-known/openid-configuration would show the issuer as https://example.org. If both hostnames are valid to hit your idp, then this is likely down to configuration.

Option 1

Your simplest is to synchronize your login authority with what the APIs expect. One of your applications is using the authority with the www prefix and is likely using the access tokens to hit other services that expect the authority to not contain www.

Option 2

You can update all your APIs to accept a list of issuers instead of just a single one. This would support both www and without at the cost of additional configuration on each level.

var issuers = new List<string>()
    {
       "https://www.example.org",
      "https://example.org"
    };
// ...
TokenValidationParameters tokenValidationParameters = new TokenValidationParameters
{
    // ...

    ValidateIssuer = true,
    ValidIssuers = issuers

    // ...
};

Option 3

You can update the configuration to make the issuer static regardless of the host used to login. The benefit of this option is that you won't get license errors in IdentityServer from having 2 issuers and you won't need to change a bunch of configuration in connected APIs. https://docs.duendesoftware.com/identityserver/v6/reference/options/

"IdentityServerOptions": {
   "IssuerUri": "https://www.example.org"
}

Duende IdentityServer error: using 2 issuers and invalid token issue

1 Answers1