Openid authentication issues in 5.4.0 version

mhernandovelasco · March 21, 2025, 7:02am

Product: PowerShell Universal
Version: 5.4.0

We have version 5.3.3 working correctly with authentication via openid. When updating to version 5.4.0 when booting the service and launching the application we observe the following error,

2025-03-21 06:07:47.189 +00:00 [ERR][Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred while executing the request.
System.InvalidOperationException: Invalid response from pushed authorization: content type is not application/json.
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetPushedAuthorizationRequestUri(HttpResponseMessage parResponseMessage)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.PushAuthorizationRequest(OpenIdConnectMessage authorizeRequest, AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsyncInternal(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.ChallengeAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, String scheme, AuthenticationProperties properties)
   at PowerShellUniversal.DashboardEndpointSource.Execute(Dashboard dashboard, HttpContext httpContext) in D:\a\universal\universal\src\Universal.Server\Routing\DashboardEndpointSource.cs:line 65
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|7_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at PowerShellUniversal.FeatureMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\FeatureMiddleware.cs:line 42
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at PowerShellUniversal.DisallowedModeMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\ModeMiddleware.cs:line 35
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at PowerShellUniversal.CspMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\CspMiddleware.cs:line 28
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at Universal.Server.Middleware.RoutingMiddleware.Invoke(HttpContext httpContext, IPolicyEvaluator policyEvaluator) in D:\a\universal\universal\src\Universal.Server\Middleware\RoutingMiddleware.cs:line 185
   at PowerShellUniversal.PSUMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\PowerShellMiddleware.cs:line 15
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Universal.Server.Middleware.WindowsAuthMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\WindowsAuthMiddleware.cs:line 58
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at Universal.Server.Middleware.SwaggerAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\SwaggerAuthMiddleware.cs:line 51
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at AspNetCoreRateLimit.RateLimitMiddleware`1.Invoke(HttpContext context) in D:\a\universal\universal\src\AspNetCoreRateLimit\Middleware\RateLimitMiddleware.cs:line 109
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.<Invoke>g__Awaited|10_0(ExceptionHandlerMiddlewareImpl middleware, HttpContext context, Task task)

How do we have openid configured? In authentication.ps1 file,

Set-PSUAuthenticationMethod -Type "OpenIDConnect" -CallbackPath "/auth/signin-oidc" -ClientId $Secret:OpenIDClient -ClientSecret $Secret:OpenIDSecret -Authority "https://xxx/oidc" -Scopes "openid profile roles" -SaveTokens $True -ResponseType code

For the time being we have reverted to version 5.3.3. Any idea of the why of this behavior?

Note: The response obtained from the provider openid if in JSON format. For example,

{
  "Claims": [
    {
      "Type": "jti",
      "Value": "xxxx",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://xxxx/oidc",
      "Properties": []
    },
    {
      "Type": "sid",
      "Value": "xxxx",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://xxxx/oidc",
      "Properties": []
    },
    {
      "Type": "name",
      "Value": "pseudo Pseudo user for service availability reporting on SMART FE",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://xxxx/ims-sso/oidc",
      "Properties": []
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
      "Value": "spp",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://xxxx",
      "Properties": []
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
      "Value": "reports",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://xxxx",
      "Properties": []
    },
    {
      "Type": "RolesAssigned",
      "Value": "true",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://www.poshtools.com",
      "Properties": []
    }
  ],
  "Identity": {
    "Name": "xxx"
  }
}

Thanks!

KST · March 21, 2025, 10:56am

“openid profile roles”

what happens if you use “openid profile groups”?

mhernandovelasco · March 21, 2025, 12:27pm

Thanks for the suggestion but my openid provider doesn’t support the ‘groups’ scope. That’s why we use roles.

adam · March 23, 2025, 11:00pm

Can you share which service you are using? 5.4 bumped the .NET version, which bumped the OIDC libraries and may be part of the problem.

mhernandovelasco · March 24, 2025, 7:53am

Hello @adam , unfortunately I do not manage the service provider implementation. It is a CAS based internal solution: CAS - OpenID Connect Authentication.

mhernandovelasco · April 1, 2025, 12:41pm

Hello @adam, sorry for mentioning you again. So I have been able to investigate with .net 9, by default, if the provider admits it Pushed Authorization (PAR) is used as authorization method.
Checking the logs again I see that the problem is there,

"...
System.InvalidOperationException: Invalid response from pushed authorization: content type is not application/json.
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetPushedAuthorizationRequestUri(HttpResponseMessage parResponseMessage)
..."

# Relevant part: "...parResponseMessage..."

I’m not quite clear if the provider we use admits it or not but (and it will probably be very hard for me to find out), in any case, is there any way to change this behaviour?

In following links:

github.com/dotnet/aspnetcore

src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs

main

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Globalization;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using Microsoft.AspNetCore.Authentication.OAuth;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.WebUtilities;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Microsoft.Extensions.Primitives;
using Microsoft.IdentityModel.JsonWebTokens;

This file has been truncated. show original

github.com/dotnet/aspnetcore

src/Security/Authentication/OpenIdConnect/src/PushedAuthorizationBehavior.cs

main

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using Microsoft.IdentityModel.Protocols.OpenIdConnect;

namespace Microsoft.AspNetCore.Authentication.OpenIdConnect;

/// <summary>
/// Enum containing the options for use of Pushed Authorization (PAR).
/// </summary>
public enum PushedAuthorizationBehavior
 {
    /// <summary>
    /// Use Pushed Authorization (PAR) if the PAR endpoint is available in the identity provider's discovery document or the explicit <see cref="OpenIdConnectConfiguration"/>. This is the default value.
    /// </summary>
    UseIfAvailable,
    /// <summary>
    /// Never use Pushed Authorization (PAR), even if the PAR endpoint is available in the identity provider's discovery document or the explicit <see cref="OpenIdConnectConfiguration"/>.
    /// If the identity provider's discovery document indicates that it requires Pushed Authorization (PAR), the handler will fail.
    /// </summary>

This file has been truncated. show original

i see that it is possible to disable Pushed Authorization (PAR) but. If so, is there any way to implement it in PSU?
I have tried it with the ‘Configure’ parameter in the ‘Set-PSUAuthenticationMethod’ cmdlet trying without any success,

Set-PSUAuthenticationMethod -Type XXX -Configure {
     $options = $args[0]
     $options.PushedAuthorizationBehavior = 'Disable'
    } 
}

Thanks in advance

adam · April 1, 2025, 4:30pm

I’m not sure why that wouldn’t work but I do think I will need to some research into this particular provider. I opened a GitHub issue so this doesn’t get buried.

github.com/ironmansoftware/powershell-universal

CAS OpenID Connect not working in 5.4

opened 04:02PM - 01 Apr 25 UTC

adamdriscoll

requires triage v5

### Description of Issue This is in reference to this forum post. Moving here t…o properly triage. https://forums.ironmansoftware.com/t/openid-authentication-issues-in-5-4-0-version/12306 ### Version 5.4.3 ### Severity High ### Hosting Method MSI (Windows Service) ### Operating System Windows ### Database SQLite ### Licensed Yes ### Features _No response_ ### Additional Environment data _No response_ ### Screenshots/Animations _No response_

adam · April 2, 2025, 1:35pm

I’m going to disable this by default and we can make it configurable in a future PSU version.

mhernandovelasco · April 4, 2025, 9:48am

Thanks @adam , version 5.4.4 installed and openid authentication works!

Topic		Replies	Views
OIDC - Broken with 5.0.0 PowerShell Universal	11	248	August 28, 2024
Issues with OpenIDConnect PowerShell Universal	0	43	September 11, 2024
OIDC authentication: Cannot redirect to the authorization endpoint, the configuration may be missing or invalid PowerShell Universal	0	109	September 27, 2024
500 Error using OpenID/Azure AD PowerShell Universal	1	635	September 13, 2021
No authentication handler is registered for the scheme 'OpenIdConnect' PowerShell Universal	5	3518	March 6, 2023

Openid authentication issues in 5.4.0 version

Related topics