Office365 - Azure AD Login not working #9214

3 Answer(s)

• 

  0

  robert created 4 years ago

  Support Team

  Hi enerjisauretim ,

  1. Firstly you need to provide a valid RedirectUri in the registered app on Azure AD Application that you have created. Example of a valid RedirectUri would be :

  http://localhost:4200/account/login

  2. Also login.service.ts file make sure that the above RedirectUri is mentioned in the method getOpenIdConnectConfig()
  3. Its important to redirect user to this /account/login route first .

  Save Cancel
• 

  0

  enerjisauretim created 4 years ago

  I found the problem; It resides to the fact that OpenIdConnecAuthProviderApi needs two claims to be properly set, one for user fullname and the other for email address. However, there are lots of bugs in that provider such as:

   Claim claim1 = validateTokenResult.Principal.Claims.FirstOrDefault<Claim>((Func<Claim, bool>) (c => c.Type == "name"));
        if (claim1 == null)
          throw new UserFriendlyException("name claim is missing !");
        Claim claim2 = validateTokenResult.Principal.Claims.First<Claim>((Func<Claim, bool>) (c => c.Type == "unique_name"));
        if (claim1 == null)
          throw new UserFriendlyException("unique_name claim is missing !");
        string[] strArray = claim1.Value.Split(' ', StringSplitOptions.None);
        return new ExternalAuthUserInfo()
        {
          Provider = "OpenIdConnect",
          ProviderKey = validateTokenResult.Token.Subject,
          Name = strArray[0],
          Surname = strArray.Length > 1 ? strArray[1] : strArray[0],
          EmailAddress = claim2.Value
        };
  

  Claim1 for user fullname and claim2 is for email address. When email address claim is not found, Sequence Contains No Elements exception is being thrown instead of an UserFriendlyException. We spend 3 whole days to configure it according to Azure AD B2B OpenId authentication. You must improve documentation for us to understand where we can get authority, login url and other relevant parameters.

  Final configuration is shown below:

      "OpenId": {
        "IsEnabled": "true",
        "ClientId": "{clientid}",
        "TenantId": "{tenantid}",
        "Authority": "https://login.microsoftonline.com/{tenantid}/v2.0",
        "LoginUrl": "https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/authorize",
        "ValidateIssuer": "false",
        "ClaimsMapping": [
          {
            "claim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
            "key": "http://schemas.microsoft.com/identity/claims/objectidentifier"
          },
          {
            "claim" : "unique_name",
            "key": "preferred_username"
          }
        ]
      },
  

  Save Cancel
• 

  0

  ismcagdas created 4 years ago

  Support Team

  Hi @enerjisauretim,

  You must improve documentation for us to understand where we can get authority, login url and other relevant parameters.

  Those are OpenID specific parameters and must be provided by your OpenId provider.

  1. Latest version of Abp.AspNetZeroCore.Web must throw UserFriendly exception. Are you using an older version ?
  2. So, did you managed to make it work ? If not, could you share the error message you are getting ?

  Thanks,

  Save Cancel