opened
rjperes
username_0
Hi,
I migrated a project from IdentityServer 4 pre-.NET Core 2.1 to 2.1. The authentication is working, identity server is running in HTTPS, client is using implicit flow and running in HTTP. After authenticating, the server redirects and I enter an infinite loop. I know the authentication is working because if I enter wrong credentials I get the appropriate message.

In the previous version, in the client's OnTokenValidated event I was setting the TokenValidationContext's Ticket property, but now this is no longer possible as this property no longer exists. Now I can set the TokenValidationContext's Principal property, and I can Succeed and HandleResult, but still no luck.

Can someone help? Anyone experienced something like this?
Thanks!
Infinite Loop
issue
created
rjperes
username_0
Any ideas?
comment
created
brockallen
username_1
There's not really enough info, and normally when the infinite loop problem exists it's normally some problem in the client, since IdentityServer is most likely doing it's job properly and returning tokens.
comment
created
4356Surf
username_2
Hello, I am having a similar issue. I am using code from the IdentityServer4.AspNetIdentity example.  Everything looks good. Using pretty much the same startup file as everyone else. When I get here:
ConsentController
        /*****************************************/
        /* helper APIs for the ConsentController */
        /*****************************************/
        private async Task<ProcessConsentResult> ProcessConsent(ConsentInputModel model)
        {
             ...   
            // indicate that's it ok to redirect back to authorization endpoint
                result.RedirectUri = model.ReturnUrl;

The returnUrl return keeps me stuck on the consent page. 

here are the logs from the point of consent succeeded:

2018-11-01 12:52:22.903 -04:00 [DBG] user_consent grant with value: 2826b42a-0d5d-4032-aef0-fefa95e7f800|978611cd-9b7b-4d20-902e-085f2a209722 not found in store.
2018-11-01 12:52:22.905 -04:00 [DBG] Found no prior consent from consent store, consent is required
2018-11-01 12:52:22.905 -04:00 [INF] Showing consent: User has not yet consented
2018-11-01 12:52:22.924 -04:00 [DBG] Start authorize request protocol validation
2018-11-01 12:52:22.925 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:22.927 -04:00 [DBG] Checking for PKCE parameters
2018-11-01 12:52:22.928 -04:00 [DBG] No PKCE used.
2018-11-01 12:52:22.928 -04:00 [DBG] Calling into custom validator: IdentityServer4.Validation.DefaultCustomAuthorizeRequestValidator
2018-11-01 12:52:22.929 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:26.824 -04:00 [DBG] Start authorize request protocol validation
2018-11-01 12:52:26.824 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:26.829 -04:00 [DBG] Checking for PKCE parameters
2018-11-01 12:52:26.829 -04:00 [DBG] No PKCE used.
2018-11-01 12:52:26.830 -04:00 [DBG] Calling into custom validator: IdentityServer4.Validation.DefaultCustomAuthorizeRequestValidator
2018-11-01 12:52:26.837 -04:00 [INF] {
  "Name": "Consent granted",
  "Category": "Grants",
  "EventType": "Information",
  "Id": 4000,
  "SubjectId": "978611cd-9b7b-4d20-902e-085f2a209722",
  "ClientId": "2826b42a-0d5d-4032-aef0-fefa95e7f800",
  "RequestedScopes": [
    "openid",
    "profile",
    "api1"
  ],
  "GrantedScopes": [
    "openid",
    "profile",
    "api1"
  ],
  "ConsentRemembered": false,
  "ActivityId": "0HLI039A1E09B:00000006",
  "TimeStamp": "2018-11-01T16:52:26Z",
  "ProcessId": 21900,
  "LocalIpAddress": "::1:5000",
  "RemoteIpAddress": "::1"
}
2018-11-01 12:52:26.852 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:26.855 -04:00 [DBG] Request path /connect/authorize/callback matched to endpoint type Authorize
2018-11-01 12:52:26.856 -04:00 [DBG] Endpoint enabled: Authorize, successfully created handler: IdentityServer4.Endpoints.AuthorizeCallbackEndpoint
2018-11-01 12:52:26.858 -04:00 [INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.AuthorizeCallbackEndpoint for /connect/authorize/callback
2018-11-01 12:52:26.861 -04:00 [DBG] Start authorize callback request
2018-11-01 12:52:26.862 -04:00 [DBG] User in authorize request: 978611cd-9b7b-4d20-902e-085f2a209722
2018-11-01 12:52:26.863 -04:00 [DBG] Start authorize request protocol validation
2018-11-01 12:52:26.863 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:26.864 -04:00 [DBG] Checking for PKCE parameters
2018-11-01 12:52:26.867 -04:00 [DBG] No PKCE used.
2018-11-01 12:52:26.867 -04:00 [DBG] Calling into custom validator: IdentityServer4.Validation.DefaultCustomAuthorizeRequestValidator
2018-11-01 12:52:26.868 -04:00 [INF] ValidatedAuthorizeRequest
{
  "ClientId": "2826b42a-0d5d-4032-aef0-fefa95e7f800",
  "ClientName": "IPA",
  "RedirectUri": "http://localhost:5002/signin-oidc",
  "AllowedRedirectUris": [
    "http://localhost:5002/signin-oidc"
  ],
  "SubjectId": "978611cd-9b7b-4d20-902e-085f2a209722",
  "ResponseType": "code id_token",
  "ResponseMode": "form_post",
  "GrantType": "hybrid",
  "RequestedScopes": "openid profile api1",
  "State": "CfDJ8LnPlyRMXsJMqDopjI_S-tW8MmumxiSLh6bXhIfOXyETwamK1y5DJ4bM5RirO2ZXTv2ioJ9ABcGSQFXxPCH0-UWLlThUy5ljSWrQHZc5FziiQDvUqgxtNB30SjEKQqIF54DlZwnLz430tCQEITUOlfJjSqTLG958i8qI_pb3Xx3ziLG2u4mw9ntJtBpNPnS_rJFfUtr7HiAM8nDzOG_SzM_OYNgp0Lg4XKNVcNuP2iEIZRBWob0mwkeNv55ONFf_NR4aI2mX4t1tfEmv5GnybSM9377CIHxuVFNbMDt-8PuaAOQ3nELF1yYipIRBm0iKQh_KamBqFkdmOIyxN4pqFeE",
  "Nonce": "636766879221860490.NDBjOGNjNzYtNGE2MS00ZTJjLTkxNjktMTJmM2RhY2M0YjA2YzgxYjgzMDAtMGM2Mi00Zjc0LTg3ODQtOTVjY2U5ZGVmNjll",
  "SessionId": "7f2846a1bc9e0bad6431b5922bac895e",
  "Raw": {
    "client_id": "2826b42a-0d5d-4032-aef0-fefa95e7f800",
    "redirect_uri": "http://localhost:5002/signin-oidc",
    "response_type": "code id_token",
    "scope": "openid profile api1",
    "response_mode": "form_post",
    "nonce": "636766879221860490.NDBjOGNjNzYtNGE2MS00ZTJjLTkxNjktMTJmM2RhY2M0YjA2YzgxYjgzMDAtMGM2Mi00Zjc0LTg3ODQtOTVjY2U5ZGVmNjll",
    "state": "CfDJ8LnPlyRMXsJMqDopjI_S-tW8MmumxiSLh6bXhIfOXyETwamK1y5DJ4bM5RirO2ZXTv2ioJ9ABcGSQFXxPCH0-UWLlThUy5ljSWrQHZc5FziiQDvUqgxtNB30SjEKQqIF54DlZwnLz430tCQEITUOlfJjSqTLG958i8qI_pb3Xx3ziLG2u4mw9ntJtBpNPnS_rJFfUtr7HiAM8nDzOG_SzM_OYNgp0Lg4XKNVcNuP2iEIZRBWob0mwkeNv55ONFf_NR4aI2mX4t1tfEmv5GnybSM9377CIHxuVFNbMDt-8PuaAOQ3nELF1yYipIRBm0iKQh_KamBqFkdmOIyxN4pqFeE",
    "x-client-SKU": "ID_NETSTANDARD1_4",
    "x-client-ver": "5.2.0.0"
  }
}
2018-11-01 12:52:26.888 -04:00 [DBG] user_consent grant with value: 2826b42a-0d5d-4032-aef0-fefa95e7f800|978611cd-9b7b-4d20-902e-085f2a209722 not found in store.
2018-11-01 12:52:26.889 -04:00 [DBG] Found no prior consent from consent store, consent is required
2018-11-01 12:52:26.889 -04:00 [INF] Showing consent: User has not yet consented
2018-11-01 12:52:26.893 -04:00 [DBG] Start authorize request protocol validation
2018-11-01 12:52:26.893 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.
2018-11-01 12:52:26.894 -04:00 [DBG] Checking for PKCE parameters
2018-11-01 12:52:26.894 -04:00 [DBG] No PKCE used.
2018-11-01 12:52:26.895 -04:00 [DBG] Calling into custom validator: IdentityServer4.Validation.DefaultCustomAuthorizeRequestValidator
2018-11-01 12:52:26.896 -04:00 [DBG] client configuration validation for client 2826b42a-0d5d-4032-aef0-fefa95e7f800 succeeded.

Any assistance from those who may have experience this would be appreciated. Thanks
comment
created
4356Surf
username_2
Commenting on my own comment, I see: 2018-11-01 12:52:26.889 -04:00 [INF] Showing consent: User has not yet consented, apparently consent is not being set, when I am.  I will look into this...,
comment
created
4356Surf
username_2
Commented out the below code segment from my startup and were G2G!
            //services.Configure<CookiePolicyOptions>(options =>
            //{
            //    options.CheckConsentNeeded = context => true;
            //    options.MinimumSameSitePolicy = SameSiteMode.None;
            //});
comment
created
JohanNorberg
username_3
The example project Quickstart3_ImplicitFlowAuthentication doesn't work for me, I get this problem, infinite redirect loop.
comment
created
JohanNorberg
username_3
Solution:
Implicit grant does not work with Firefox when using 'http' only 'https'
To get the samples to work, you have to (for both the AuthorizationServer project and the Client project: 
1. Right click the project. 
2. Properties
3. Check 'Enable SSL'
4. Copy the new URL that will be displayed just right of the 'enable SSL' checkbox. 
5. On Client model: Change RedirectUris & PostLogoutRedirectUris to use https and the new URL. 
6. In client: Change options.Authority to use the https URL.
comment
closed
brockallen
username_1
issue