We have an existing .NET 6 Web Application, protected with Duende Identity Server 6, running on Azure App Service. This works flawlessly.
We want to add Azure App Service Authentication in front of the this Azure App Service. That way we can enforce our company Active Directory (incl. MFA) to be used before even accessing the Web Application.
Our web-application is an OIDC client that calls an Duende OIDC Identity Server with it's own credential store.
Setting up App Service Authentication with our corporate AD works. We need to authenticate before we can access our Web Application.
After logging in on our OIDC Identity Server, a redirect takes place to https://webapp.com/signin-oidc. That responds with a 403-forbidden.
If I intercept the call to https://webapp.com/signin-oidc and remove the User-Agent header, it works! So I guess there is some CORS issue that I can't solve yet.
Things I tried:
- Set Allowed Origins to "*" on webapp.com
- Set Allowed Origins to "*" on our Identity Server web app
- Added allowed Redirect url https://webapp.com/signin-oidc to the Azure App Service Authentication settings
Anything I forget or should think of?
Many thanks in advance!
Reproduced with this very basic ASP.NET 6 MVC application:
using System.IdentityModel.Tokens.Jwt;
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
builder.Services.AddControllersWithViews();
JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.Authority = "https://our-login-authority-url.com";
options.ClientId = "com.company.app";
options.ClientSecret = "<.. secret ..>";
options.ResponseType = "code";
options.UsePkce = true;
options.Scope.Clear();
options.Scope.Add("openid");
options.Scope.Add("profile");
options.Scope.Add("offline_access");
// keeps id_token smaller
options.GetClaimsFromUserInfoEndpoint = true;
options.SaveTokens = true;
});
var app = builder.Build();
// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
app.UseExceptionHandler("/Home/Error");
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}")
.RequireAuthorization();
app.Run();
Network-log. "Sensitive" data obscured.
Header information from POST /signin-oidc request:
POST /signin-oidc HTTP/1.1
Host: mywebapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: nl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 699
Origin: null
DNT: 1
Connection: keep-alive
Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8K<...>NaM5Tw==
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
Update: Origin: null
If the Origin value is set to the OIDC authority url that is also an allowed return url in Azure App Service Authentication settings - it works.
Now I need to investigate why the POST from Identity Server does not contain a Origin value in the header.
