3

In the last couple months, we have seen our ability to reliably find the endpoint for Google's OpenId plummet in our Azure Cloud hosted environments. This used to be a problem that would only crop up once in a blue moon, but in the last month the number of users reporting the issue has risen dramatically. I have also noticed that the problem can be more or less prevalent from deployment to deployment. Implying that there is an intermittent issue communicating from specific azure servers to the google endpoint?

With the rise we added logging for this and here are the results:

DEBUG 13 03 2014 20:35:42,598 [89]: HTTP GET https://www.google.com/accounts/o8/id
DEBUG 13 03 2014 20:35:42,723 [89]: An Error event occurred in Test AuthenticationService at 3/13/2014 8:35:42 PM.

  Client IP: 75.151.81.33
  Client Host: NT AUTHORITY\SYSTEM
  Server Host: 10.28.174.102:443
  Details:
====================

    Error in openid popup request authentication, DotNetOpenAuth.Messaging.ProtocolException: No OpenID endpoint found. ---> System.InvalidOperationException: Sequence contains no elements
        at System.Linq.Enumerable.First[TSource](IEnumerable`1 source)
        at DotNetOpenAuth.OpenId.RelyingParty.OpenIdRelyingParty.CreateRequest(Identifier userSuppliedIdentifier, Realm realm, Uri returnToUrl)
        --- End of inner exception stack trace ---
        at DotNetOpenAuth.OpenId.RelyingParty.OpenIdRelyingParty.CreateRequest(Identifier userSuppliedIdentifier, Realm realm, Uri returnToUrl)
        at Website.Controllers.OpenIdController.GetProviderRequest(OpenIdProvider provider, String platform, Boolean isNewAccount) in c:\src-r\Website\Controllers\OpenIdController.cs:line 152

ERROR 13 03 2014 20:35:42,723 [89]: 
    Error while performing discovery on: "https://www.google.com/accounts/o8/id": DotNetOpenAuth.Messaging.ProtocolException: Error occurred while sending a direct message or getting the response. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
        at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
        --- End of inner exception stack trace ---
        at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
        at System.Net.FixedSizeReader.ReadPacket(Byte[] buffer, Int32 offset, Int32 count)
        at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
        at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
        at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
        at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
        at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
        at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
        at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
        at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
        at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
        at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
        at System.Net.ConnectStream.WriteHeaders(Boolean async)
        --- End of inner exception stack trace ---
        at System.Net.HttpWebRequest.GetResponse()
        at DotNetOpenAuth.Messaging.StandardWebRequestHandler.GetResponse(HttpWebRequest request, DirectWebRequestOptions options)
        --- End of inner exception stack trace ---
        at DotNetOpenAuth.Messaging.StandardWebRequestHandler.GetResponse(HttpWebRequest request, DirectWebRequestOptions options)
        at DotNetOpenAuth.Messaging.UntrustedWebRequestHandler.GetResponse(HttpWebRequest request, DirectWebRequestOptions options)
        at DotNetOpenAuth.Yadis.Yadis.Request(IDirectWebRequestHandler requestHandler, Uri uri, Boolean requireSsl, String[] acceptTypes)
        at DotNetOpenAuth.Yadis.Yadis.Discover(IDirectWebRequestHandler requestHandler, UriIdentifier uri, Boolean requireSsl)
        at DotNetOpenAuth.OpenId.UriDiscoveryService.Discover(Identifier identifier, IDirectWebRequestHandler requestHandler, Boolean& abortDiscoveryChain)
        at DotNetOpenAuth.OpenId.RelyingParty.OpenIdRelyingParty.Discover(Identifier identifier)
        at DotNetOpenAuth.OpenId.RelyingParty.AuthenticationRequest.Create(Identifier userSuppliedIdentifier, OpenIdRelyingParty relyingParty, Realm realm, Uri returnToUrl, Boolean createNewAssociationsAsNeeded)

I Thought is might be a timeout issue so I tried increasing the Timeouts on the untrustedWebRequest (no effect).

<untrustedWebRequest timeout="00:00:30" readWriteTimeout="00:00:15.000">

We had the thought there might be a time issue so we resynced the instances to time.nist.gov (no effect).

I did run across this discussion on google groups: https://groups.google.com/forum/#!msg/dotnetopenid/SWw10f8MI_E/PXzb15jAFloJ

Though it has not resulted in an answer yet.

kkychuck
  • 93
  • 5
  • 1
    I am facing the exact same issue. You can take a look at http://stackoverflow.com/questions/21420019/dotnetopenauth-4-3-and-google-oauth-1-0-deprecated post – user2585299 Mar 25 '14 at 02:49
  • While it isn't an answer to the problem in general, migrating from OpenId 2.0 to OpenId Connect with Google OAuth 2.0 does seem to have resolved our issue. I am not convinced that it has just yet, more time and data will be needed. – kkychuck Apr 14 '14 at 19:58
  • @kkychuck Did OpenId connect fix your problem? We have the exact same problem. Thanks! – NullReference May 23 '14 at 22:50
  • 1
    @NullReference It has been a little over a month, and I do not believe we have received any more reports of this problem once we upgraded to OpenId Connect via Google's OAuth 2.0. – kkychuck May 25 '14 at 11:36

0 Answers0