OpenIdConnectAuthenticationHandler: message.State is null or empty

Question

I am using UseOpenIdConnectAuthentication middleware for ASP.Net Core application to authenticate against Dells Cloud access manager token provider (setup to provide OpenId/OAuth2 authentication). Following is the code:

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            AuthenticationScheme = "ClientCookie",
            CookieName = CookieAuthenticationDefaults.CookiePrefix + "ClientCookie",
            ExpireTimeSpan = TimeSpan.FromMinutes(5),
            LoginPath = new PathString("/signin"),
            LogoutPath = new PathString("/signout")
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
        {
            RequireHttpsMetadata = false,
            SaveTokens = true,
            ClientId = "XYZClient_Id",
            ClientSecret = "XYZ_ClientSecret",
            ResponseType = OpenIdConnectResponseType.Code,
            PostLogoutRedirectUri = "https://example.com",
            Configuration = new OpenIdConnectConfiguration {
                AuthorizationEndpoint = "https://CAM.COM/CloudAccessManager/RPSTS/OAuth2/Default.aspx",
                TokenEndpoint = "https://CAM.COM/CloudAccessManager/RPSTS/OAuth2/Token.aspx",
                UserInfoEndpoint = "https://CAM.COM/CloudAccessManager/RPSTS/OAuth2/User.aspx",
                Issuer= "urn:CAM.COM/CloudAccessManager/RPSTS",
            }
        });

But I am stuck at one point for a few hours now. I get the following error:

SecurityTokenInvalidSignatureException: IDX10500: Signature validation failed. There are no security keys to use to validate the signature

I am getting code and state back in url querystring https://example.com/signin-oidc?code=somecode&state=somestate

Any type of guidance is appreciated.

---

UPDATE Added Issuer Signing key:

TokenValidationParameters = new TokenValidationParameters
                {
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration.GetValue<string>("AppSettings:ClientSecret")))
                }

Misread

Answer 1

The error you're seeing is caused by the fact you're not using the OpenID Connect provider configuration discovery feature offered by the OIDC middleware, that allows it to retrieve the cryptographic keys used to sign identity tokens.

If your provider supports this feature, remove the entire Configuration node and set Authority instead. All the endpoints should be automatically registered for you.

If it doesn't support this feature, you'll have to manually add the signing keys to OpenIdConnectOptions.TokenValidationParameters.IssuerSigningKeys.

View

This saved a lot of my time and can get started with manually adding the signing keys since my provider does not provide a configuration discovery end point. Also thank you for the instant reply – Misread

What if I get the same error message but have no UseOpenIdConnectAuthentication and instead am using AddMicrosoftIdentityWebApp on my AddAuthentication()? That's the Azure based and today recommended MIP (Microsoft Identity Platform). – Chemarin

Answer 2

This error means that your OpenID Connect Provider did not send a state parameter in its response alongside the authentication code. However, state is a mandatory parameter if it was included in the request URL sent to the OpenID Connect provider (see these docs).

If the OpenID Connect Provider works as expected. that means the state value was not sent in the login request URL. In my case that happened because I used the wrong login request URL and modified my backend response in OpenIdConnectOptions.Events.OnRedirectToIdentityProvider.

Pisano

Answer 3

I got this error when the Scope was wrong, to fix it I appended a .default at the end.

"Scopes": "https://Company.onmicrosoft.com/OAuth2.POC.MicroServiceAPI/.default"

Todhunter