Endpoint belongs to different authority

Question

trying to use Azure AD as OpenID provider with IdentityModel package

However the problem is that it produces wrong endpoint configuration

var client = new HttpClient();

const string identityUrl = "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/v2.0";
const string restUrl = "https://localhost:44321";

var disco = await client.GetDiscoveryDocumentAsync(identityUrl);
if (disco.IsError)
{
    Console.WriteLine(disco.Error); 
    return;
}

returns error

Endpoint belongs to different authority: https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/authorize

openid-configuration output is

{"authorization_endpoint":"https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/authorize",
"token_endpoint":"https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/token" ... }

oauth2 is added between the tenatID and version. I suppose this is why openid metadata validation fails.

Is it possible to configure AzureAD to return correct metadata for the openid-configuration ?

Regards

there is special test `DiscoveryPolicyTests.Endpoints_not_beneath_authority_must_be_allowed_if_whitelisted` in the IdentityModel source code. Seems that this check is done by purpose. However this can be turned off using `policy.ValidateEndpoints = false`. But I have serious doubts that turning endpoint checks is a good idea. — oleksa, Jun 13 '19 at 07:38

score 10 · Accepted Answer · answered Aug 31 '20 at 11:43

could you find a solution for this? The only way I could figure out (far to be the optimal solution) is to add the endpoints to a list of additional endpoint base addresses. Otherwise you have to set the validations to false as stated in the comments above.

var client = httpClientFactory.CreateClient();
       var disco = await client.GetDiscoveryDocumentAsync(
            new DiscoveryDocumentRequest
            {
                Address = "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/v2.0",
                Policy =
                {
                    ValidateIssuerName = true,
                    ValidateEndpoints = true,
                    AdditionalEndpointBaseAddresses = { "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/token",
                                                        "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/authorize",
                                                        "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/discovery/v2.0/keys",
                                                        "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/devicecode",
                                                        "https://graph.microsoft.com/oidc/userinfo",
                                                        "https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/oauth2/v2.0/logout"
                                                      }
                },
            }
        );

well this looks fine - at least it will validate the endpoints properly. However additional configuration changes should be made to store alternative endpoints paths in the config file — oleksa, Aug 31 '20 at 13:16
This seems to be working fine. Another new endpoint that you should use is kerberos: https://login.microsoftonline.com/00edae13-e792-4bc1-92ef-92a02ec1d939/kerberos/ — Suciu Eus, Jun 28 '21 at 08:17

score 1 · Answer 2 · answered Jul 05 '21 at 20:55

If you take a look at the code inside IdentityModel repository, you can see that the default validation of the endpoints validates them by doing a "starts with" method. https://github.com/IdentityModel/IdentityModel/blob/1db21e2677de6896bc11227c70b927c502e20898/src/Client/StringComparisonAuthorityValidationStrategy.cs#L46

Then the only two required AdditionalEndpointBaseAddresses inside the DiscoveryDocumentRequest Policy field you need to add are "https://login.microsoftonline.com/<guid>" and "https://graph.microsoft.com/oidc/userinfo".

score 0 · Answer 3 · answered Feb 03 '21 at 18:31

0

I had the same problem as well and when i upgraded IdentityModel to version 2.16.1 the problem was solved

answered Feb 03 '21 at 18:31

rozturac

11
1

score 0 · Answer 4 · answered Jun 28 '21 at 08:22

Azure AD seems to need Additional Endpoints configuration as @flacid-snake suggested. Setting validate endpoints to False is a security threat and should be avoided.

The best way is to make it configurable, preferable in the UI when you configure the SSO server. Endpoints can change and they should be easy to change. It will also make it easier if you later decide to support Okta or other providers and they require additional endpoints.

As of June 2021 you also need to include Kerberos endpoint like: https://login.microsoftonline.com/888861fc-dd99-4521-a00f-ad8888e9ecc8bfgh/kerberos (replace with your directory tenant id).

Endpoint belongs to different authority

4 Answers4