josephdecock
commented
1 year ago PKCE is critically important for security. I recommend that you re-enable it, unless you have a very specific reason for disabling it and understand your threat model.
There can sometimes be issues with parsing jwts caused by incompatibilities in versions some of microsoft's nuget packages related to jwts and identity (they aren't following semantic versioning conventions unfortunately). Try updating all such packages in the client application and see if that helps.
horststumpf
I have the follow Update Process
Follow Tests:
An unhandled exception occurred while processing the request. ArgumentNullException: IDX10000: The parameter 'json' cannot be a 'null' or an empty object. (Parameter 'json') Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectMessage..ctor(string json) OpenIdConnectProtocolException: Failed to parse token response body as JSON. Status Code: 403. Content-Type: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest) Exception: An error was encountered while handling the remote login. Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()The CLient
`new Client { ClientId = Clients.LandingPageId, ClientName = "Open ID client - landing page", AllowedGrantTypes = GrantTypes.HybridAndClientCredentials, RequirePkce = false, ClientSecrets = { new Secret("spiritSecret".Sha256()) },
Asp.net app
services.AddAuthentication(options => { options.DefaultScheme = "Cookies"; options.DefaultChallengeScheme = "oidc"; }) .AddCookie("Cookies") .AddJwtBearer("Bearer", options => { options.Authority = applicationConfiguration.ServerAddresses.IdentityServer; options.RequireHttpsMetadata = false; options.Audience = ResourceScopes.LandingApi; }) .AddOpenIdConnect("oidc", options => { options.SignInScheme = "Cookies"; options.Authority = applicationConfiguration.ServerAddresses.IdentityServer; options.RequireHttpsMetadata = true; options.ClientId = Clients.LandingPageId; options.ClientSecret = "spiritSecret"; options.ResponseType = "code id_token"; options.UsePkce = false; options.Scope.Add("offline_access"); options.Scope.Add(ResourceScopes.LandingPage); options.Scope.Add(ResourceScopes.TokenResource); options.SaveTokens = true; options.GetClaimsFromUserInfoEndpoint = true; options.UseTokenLifetime = true; options.Events.OnRedirectToIdentityProviderForSignOut += OnRedirectToIdentityProviderForSignOut; });