possible bug in sample

[zbrad]

With the code as is, it is throwing an exception in OnAuthorizationCodeReceived, specifically the notification.RedirectUri is empty.

The code looks odd, since it gets an authResult, but doesn't do anything with it, but mentions it should be caching it for TodoList API?

[dstrockis]

Hey zbrad. This code does indeed cache the authResult for later use (in TodoListController).

The use of notification.RedirectUri does seem suspect - It should use notification.HttpContext instead, as is done here: https://github.com/AzureADSamples/WebApp-WebAPI-OpenIDConnect-DotNet/blob/master/TodoListWebApp/App_Start/Startup.Auth.cs#L82

[npnelson]

I am probably missing something easy, but I couldn't figure out the combination to get this to work. HttpContext doesn't expose .Current in ASPNET5.

Can you give me the ASPNET5 equivalent to the code you referenced (pertinent part below)?

new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), 

[dstrockis]

@brentschmaltz do you know if there is a better way to construct the request url than
String.Format("{0}://{1}{2}", notification.Request.Scheme, notification.Request.Host.ToUriComponent(), notification.Request.Path.ToUriComponent())

@npnelson if you set options.RedirectUri in Startup.Auth.cs in app.UseOpenIdConnectAuthentication(options... you should be able to use notification.RedirectUri as the sample currently does.

[npnelson]

@dstrockis Thanks. I gave that a shot and I am still coming up short. AcquireTokenSilentAsync() fails, but I am not sure why, because it looks like there is a token in the cache. I tried downloading the source so I could debug it myself but then I ran into strong name key signing problems, so I gave up. At this point, I am probably missing something silly.

It's not a big deal for me right now, because I have plenty of other things I am looking at and it seems beta4 is right around the corner. Everything will need to be updated then anyway.

[dstrockis]

Ok cool. If you get the chance, could you post the exception details from acquireTokenSilent? Also taking a Fiddler trace would help. The token in the cache is a token for the graph Api, not for the todo list api. So acquireTokenSilent will make a request to AAD to get an access token with a refresh token. I suspect something is going wrong in that request.

[npnelson]

@dstrockis Well...you aren't going to believe this (I wouldn't if I were you). I reproduced the error this morning, then I took the try/catch block out of the TodoListWebApp.ToDoListController so I could get a better idea of why AcquireTokenSilentAsync failed.

It still threw an AdalSilentTokenAcquisitionException, so I decided to see if I could get a token to the ToDoListService in the OnAuthorizationCodeReceived by calling AcquireTokenByAuthorizationCodeAsync with the ResourceID for the ToDoListService after the call to AcquireTokenByAuthorizationCodeAsync for the GraphResourceID. This time, I got a very descriptive error, something like the application didn't have the rights to read Active Directory. The TodoListWebApp had rights to the TodoListService and "Enable sign-on and read users' profiles" was checked for the Windows Azure Active Directory permissions. I enabled the other three permissions for Azure AD and everything started to work . I removed the three additional permissions and everything still worked.

I set up another ToDoListWebApp in Azure AD and everything worked again. Maybe there was a problem when I set up the ToDoListWebApp initially in Azure (or more likely user error).

At this point, I don't think there is anything wrong with the sample, except for the redirect URI. If other users start to report similar issues, then maybe there is an intermittent bug in the Azure management portal.

If it's possible, you might want to consider putting more detail in the AdalSilentTokenAcquisitionException. All it said was failed to acquire token silently.

[dstrockis]

Huh. How strange. Thanks for reporting back.

I'll take your AcquireTokenSilent exception back to the team, I think that's valid.

Going to leave this issue as open until I have time to change the redirectUri code and test it out.

[michael-freidgeim-webjet]

@npnelson , please put more detail in the AdalSilentTokenAcquisitionException. Currently "AdalSilentTokenAcquisitionException: Failed to acquire token silently. Call method AcquireToken"
hides the actual response.
I have to use Fiddler (which obviously will not be available in production) to view the actual error, which can be different.
E.g I had "The user or administrator has not consented to use the application with ID 'xxx'. Send an interactive authorization request for this user and resource." and some others.

[npnelson]

@michael-freidgeim-webjet Thanks for the idea. I will try that next time something like this pops up. A lot has changed since my original comment. I forget exactly what I was even trying to accomplish, but with all of the updates since then, I've been able to accomplish everything I've needed.

[michael-freidgeim-webjet]

Sorry, @npnelson , I was confused and decided that you are from Microsoft.
@dstrockis, could you please look at my suggestion above to include actual error details to AdalSilentTokenAcquisitionException

[jmprieur]

No longer repros in the update for ASP.NET Core 2.0