The OpenIddict ASP.NET Core server cannot be used as the default scheme handler

Question

I'm trying OpenIddict 3.0. I followed the steps in the documentation, created an Authorize controller, and added a test application. When I try to run I get this exception:

The OpenIddict ASP.NET Core server cannot be used as the default scheme handler. Make sure that neither DefaultAuthenticateScheme, DefaultChallengeScheme, DefaultForbidScheme, DefaultSignInScheme, DefaultSignOutScheme nor DefaultScheme point to an instance of the OpenIddict ASP.NET Core server handler

I cannot find what I'm doing wrong.

Here is my Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<ApplicationDbContext>(options =>
    {
        // Configure the context to use Microsoft SQL Server.
        options.UseInMemoryDatabase("Identity");

        // Register the entity sets needed by OpenIddict.
        // Note: use the generic overload if you need
        // to replace the default OpenIddict entities.
        options.UseOpenIddict<Guid>();
    });

    AddIdentityCoreServices(services);

    services.AddOpenIddict()

            // Register the OpenIddict core components.
            .AddCore(options =>
            {
                // Configure OpenIddict to use the Entity Framework Core stores and models.
                options.UseEntityFrameworkCore()
                        .UseDbContext<ApplicationDbContext>()
                        .ReplaceDefaultEntities<Guid>();
            })

            // Register the OpenIddict server components.
            .AddServer(options =>
            {
                // Enable the token endpoint (required to use the password flow).
                options.SetTokenEndpointUris("/connect/token");

                // Allow client applications to use the grant_type=password flow.
                options.AllowPasswordFlow();

                // Mark the "email", "profile" and "roles" scopes as supported scopes.
                //options.RegisterScopes(OpenIddictConstants.Scopes.Email,
                //                       OpenIddictConstants.Scopes.Profile,
                //                       OpenIddictConstants.Scopes.Roles);

                // Accept requests sent by unknown clients (i.e that don't send a client_id).
                // When this option is not used, a client registration must be
                // created for each client using IOpenIddictApplicationManager.
                options.AcceptAnonymousClients();

                // Register the signing and encryption credentials.
                options.AddDevelopmentEncryptionCertificate()
                        .AddDevelopmentSigningCertificate();

                // Register the ASP.NET Core host and configure the ASP.NET Core-specific options.
                options.UseAspNetCore()
                        .EnableAuthorizationEndpointPassthrough() // Add this line.
                        .EnableTokenEndpointPassthrough()
                        .DisableTransportSecurityRequirement(); // During development, you can disable the HTTPS requirement.
            })

            // Register the OpenIddict validation components.
            .AddValidation(options =>
            {
                // Import the configuration from the local OpenIddict server instance.
                options.UseLocalServer();

                // Register the ASP.NET Core host.
                options.UseAspNetCore();
            });

    // ASP.NET Core Identity should use the same claim names as OpenIddict
    services.Configure<IdentityOptions>(options =>
    {
        options.ClaimsIdentity.UserNameClaimType = OpenIdConnectConstants.Claims.Name;
        options.ClaimsIdentity.UserIdClaimType = OpenIdConnectConstants.Claims.Subject;
        options.ClaimsIdentity.RoleClaimType = OpenIdConnectConstants.Claims.Role;
    });

    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme;
    });

    services.AddControllers();
}

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.UseHttpsRedirection();

    app.UseRouting();

    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
    });
}

private static void AddIdentityCoreServices(IServiceCollection services)
{
    var builder = services.AddIdentityCore<ApplicationUser>();
    builder = new IdentityBuilder(
        builder.UserType,
        typeof(ApplicationRole),
        builder.Services);

    builder.AddRoles<ApplicationRole>()
        .AddEntityFrameworkStores<ApplicationDbContext>()
        .AddDefaultTokenProviders()
        .AddSignInManager<SignInManager<ApplicationUser>>();
}

Please assist me on what I'm doing wrong.

Boong

try services.AddAuthentication(options =>{ options.DefaultScheme=CookieAuthenticationDefaults.AuthenticationScheme;}) or services.AddAuthentication(); instead of the code at line services.AddAuthentication(...) – Syndesis

Error sais you can't use options.DefaultAuthenticateScheme = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme; as the default scheme – Syndesis

changing to services.AddAuthentication() gives No authenticationScheme was specified, and there was no DefaultChallengeScheme found error – Boong

Answer 1

I finally figured out where I went wrong. @Train Thanks for pointing me in the right direction.

changing the services.AddAuthentication(...) from

services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme;
    });

to

services.AddAuthentication(options =>
            {
                options.DefaultScheme = OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
            });

Boong

Answer 2

What's you're method of authentication? Cookie? JWT?

You need to change this line of code. You can't set OpenIddictServerAspNetCoreDefaults.AuthenticationScheme; as the default scheme

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme;
});

Default Authentication Scheme

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme);

or overload

services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
});

Here are the docs on Authentication with a lot more to read up on.

Syndesis