last day (15 days later) » 

9:20 AM
2
Q: Identity Server 4 - unauthorized client

M UI am struggling with basic setup of the Identity Server 4 with Net Core 3.0 and React (but this is almost irrelevant). I have generated new app by dotnet new react -au Individual, updated dependencies etc, Created config basically copied from the demo server with the following: public static IE...

 
M U
How to do it in appsettigs.json
 
d_f
Unknown client or client not enabled means you provided a wrong client_id with your request. and code challenge required means that postman does not support PKCE I don't use Postman, but google gives me that
 
M U
Any help to change it to disable PKCE within appsettings.json ` "IdentityServer": { "Key": { "Type": "Development" }, "Clients": { "spa": { "Profile": "IdentityServerSPA", } } }`
 
d_f
not sure how to handle that with profiles, they are more or less hardcoded, but you can start whit this configuration where set RequirePkce = false
 
M U
It does not work at all with clients defined in code :/ just does not load it for some reason
it is executed but the client not being used
spa will work without issue when defined in json with the predefined base , but any id won't work with the code...
I've tried.client is recognized but no way to disable pkce
 
d_f
9:20 AM
well, here is the place where the profiles come from. Up to me, if pre-defined solution doesn't work for you, you can remove AddApiAuthorization(), or at least move it up in your service builder calls, so that it will not override your manual config
 
M U
Hello
Maybe we can chat here instead of dozens of comments
services.AddIdentityServer(o =>
{
o.UserInteraction.ErrorUrl = "/myErrorsHandler";
})
.AddApiAuthorization<ApplicationUser, ApplicationDbContext>()
.AddInMemoryClients(GetClients());
I have this right now
and this:
private static List<Client> GetClients()
{
return new List<Client>
{
new Client
{
ClientId = "spa",
ClientName = "spa",
RequireConsent = false,
RequirePkce = false
}
};
}
but still it does not load this client at all
if I add the client in JSON it is recognized without any issues
 
d_f
9:45 AM
for me your initial client configuration (in the original post) looks better, so probably the latest one can't be loaded because of validation. you can check your IdSrv logs.
there should not be any magic, and you can check yourself that all services.AddIdentityServer().. .AddInMemoryXxx() come from IdSrv Core, when .AddApiAuthorization() comes from MS template. (follow the links in my previous comment to see the internals)
 
M U
10:17 AM
I don't see any errors in logs. I have tried with the initial client and it is still the same - not getting loaded.
I have commented `AddApiAuthorization()` and provided AddInMemory... but it is not working anyway
 
d_f
well, but have anything in the logs? probably you don't have them attached at all?
 
M U
I moved to something like this to try:
```
services.AddIdentityServer(o => { o.UserInteraction.ErrorUrl = "/myErrorsHandler"; })
.AddApiAuthorization<ApplicationUser, ApplicationDbContext>(c =>
{
c.Clients = new ClientCollection(GetClients());
});
```
but in logs...
info: Microsoft.Extensions.DependencyInjection.ConfigureApiResources[0]
Configuring local API resource 'accountsReactAPI'.
info: Microsoft.AspNetCore.ApiAuthorization.IdentityServer.ConfigureClients[0]
Configuring client 'accountsReact'.
info: Microsoft.AspNetCore.ApiAuthorization.IdentityServer.ConfigureSigningCredentials[0]
Loading development key at ***/accounts/obj/tempkey.json'.
info: Microsoft.AspNetCore.ApiAuthorization.IdentityServer.Configuration.ConfigureClientScopes[0]
 
d_f
10:32 AM
so you do not get any logs from the Identityserver itself
If it's not vital to play with MS template, that must be much more simple and clear to throw that all away and start from something stable, like the IdentityServer4.Quickstart.UI
 
M U
10:57 AM
but those templates are still on NET Core 2.x
so they are not useful in my opinion?
because of big changes in terms of relations between IS and NetCore in 3.0
 
d_f
if you strictly need (still beta) 3.0, then probably yes... but regarding the relations... that's mostly that template on MS side, and IdSrv is more or less the same, as I see the situation
 
M U
3.0 is production ready regardless preview. It is new project (this accounts service) so I don't want to start with 2 and then updating it
 
d_f
11:23 AM
Well, so... you can use this quickstart. It's 3.0 and it's directly from IdSrv team
by the way, I guess you don't have anything like this in your program.cs, so it does not print IS logs
 

last day (15 days later) »