OpenID Connect HTTP 500 Error

[tom.obrien]

Hi Guys,
I’ve noticed a problem with using OpenID Connect to use AzureAD accounts to log in. It is a similar error to my other post about multi-tenant authentication although it only happens on first login and then allows you to log in if you try again (which the multi-tenant setup doesn’t).

If I log into the dashboard I’m prompted for my Azure AD credentials. It then redirects me back to http://localhost:10000/signin-callback where it gives me the http 500 error:

If I then go back to http://localhost:10000 I’m prompted to log in again:

It asks me for my AzureAD credentials again but this time it does redirect correctly and takes me to the home page.

Does anyone know why the first login might do this?

[adam]

Strange. Is there anything relevant in the logs?

One problem is that the logging probably isn’t verbose enough to show the actual error.

I’ll make sure this issue gets resolved:

Add a cmdlet to provide logs for Authentications providers

[tom.obrien]

Hi Adam,
If I enable debug logging I get the following on the first login attempt:

09:13:01 [Debug] PowerShellExecutionService ExecutionService constructor
09:13:01 [Error] Microsoft.AspNetCore.SignalR.HubConnectionHandler Error when dispatching ‘OnDisconnectedAsync’ on hub.
09:13:01 [Error] Microsoft.AspNetCore.Http.Connections.Internal.HttpConnectionManager Failed disposing connection htj5mJ9WpGIAekAq84gPZQ.
09:13:01 [Info] Microsoft.AspNetCore.Hosting.Internal.WebHost Request finished in 54982260.1747ms 101
09:13:04 [Info] Microsoft.AspNetCore.Hosting.Internal.WebHost Request starting HTTP/1.1 POST http://localhost:10000/signin-callback application/x-www-form-urlencoded 3704
09:13:04 [Warn] Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler ‘.AspNetCore.Correlation.OpenID.n6gG3rnm99YievWLZoOs08a67lprB_EIpHcw1GzRrRE’ cookie not found.
09:13:04 [Info] Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler Error from RemoteAuthentication: Correlation failed…
09:13:04 [Error] Microsoft.AspNetCore.Server.Kestrel Connection id “0HLURMI57CPEV”, Request id “0HLURMI57CPEV:00000001”: An unhandled exception was thrown by the application.
09:13:04 [Info] Microsoft.AspNetCore.Hosting.Internal.WebHost Request finished in 4.3703ms 500

After doing a bit more testing I’ve noticed:

The account I’m logging in with is already ‘signed in’ to AzureAD (which is quite normal):

If I sign out of the account then re-load and log back into the dashboard again I can get in first try. The same also happens when using an in-private browser session, as it isn’t already signed in and prompts for credentials the first time, it is able to log into the dashboard first time. It seems to only happen when the account you try to log in with is already signed in to Azure AD.

[adam]

Ah, interesting. Seems like something we need to fix in UD. I’ve opened a place holder issue here: https://github.com/ironmansoftware/universal-dashboard/issues/1607

If there is any more information you’d like to add, please comment.

[tom.obrien]

Thanks Adam, I’m wondering if the other issue I’m having with multi-tenant authentication is related:

Azure Multi-Tenant Authentication

Hi Guys, I’m able to use OpenID connect to authenticate with AzureAD and I’m able to run Azure PowerShell commands in the user’s context successfully. I want to be able to take it a step further and make the dashboard multi-tenant. i.e. Users from different tenants can authenticate with their Azure AD credentials and log in. In theory it should be possible… by enabling the Azure app registration for multi-tenant use: [tenant1] and changing the authority in the authentication method from: ht…

I’ll do some more testing and will update if I find anything that might be of help.

[tom.obrien]

@adam do you know if there are any updates on this issue? I’m getting close to releasing a product which uses UD and it’s going to be a real issue for me as it gives users a really bad experience if they get http500 errors every time they try to log in.