Unauthorized access 401 while accessing openid userinfo endpoint on ADFS server

Question

0.00/5 (No votes)

See more:

I'm trying to access the openId userInfo endpoint for a user on ADFS(not hybrid), with the following request using WebClient API:

//accessToken variable contains access token data
string userInfoURL = "https://[base-server-url]/userinfo?" + accessToken;
Uri userInfoUri = new Uri(userInfoURL);
byte[] userInfoBytes = webClient.DownloadData(userInfoUri);
string response = Encoding.UTF8.GetString(userInfoBytes);

I have successfully created a new Application Group with a Server Application as well as a Web API and the OpenID Connect protocol. The client permission is checked with openid oprtion. The Relying Party identifier is the same GUID as Client ID of the Server Application.

I have included {"scope", "openid"} during access token request. I am not looking for a custom token details, but only details from openid scope. As per my research only 'sub' value is accessible in this request. I would like to proceed with that.

While considering the access token and oauth authentication process, there is no issue with the access token and related procedures. But userinfo endpoint access fails.

What I have tried:

The response fails with '401' Unauthorized error.

Event logs from ADFS server is listed below:

(1)Received request with following properties:

Date: 2020-07-16 09:48:38 Remote endpoint: remote-ip(Not disclosing details) Local endpoint: local-ip(Not disclosing details) Http method: GET Request Url: /adfs/userinfo Query string: ?access_token=eyJ0eXAiOi....(Not disclosing details) Local Port: 443 User agent string: - Body data length: 0 Caller Identity: - Certificate Identity: - Relying Party: - Through proxy: False Proxy name: - Serialized Header: {"Host":"[host-name(Not disclosing details)]","X-MS-Endpoint-Absolute-Path":"/adfs/userinfo"}

(2)Following request context headers present:

X-MS-Client-Application: - X-MS-Client-User-Agent: - client-request-id: - X-MS-Endpoint-Absolute-Path: /adfs/userinfo X-MS-Forwarded-Client-IP: - X-MS-Proxy: - X-MS-ADFS-Proxy-Client-IP: -

(3)UserInfoListener.ParseRequest: Cannot find access token in the request.

(4)Sending response at time: '2020-07-16 09:48:38' with StatusCode: '401' and StatusDescription: 'Unauthorized'. Response headers set: {"WWW-Authenticate":"Bearer error="invalid_token", error_description="MSIS9923: Received invalid UserInfo request. Access token is not present in the request. The access token needs to be carried in Authorization Request Header Field or Form-Encoded Body Parameter."","Content-Type":"text/html; charset=utf-8"}

(5)UserInfoListener.WriteErrorResponse: The UserInfo endpoint meets error when process the request. Writing error response.

I appreciate any advice.

Posted 18-Jul-20 21:41pm

Member 10014841

Updated 15-Dec-20 10:32am

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Garth J Lancaster · Answer 1 · 2020-07-18T22:31:00

Solution 1

Your code has this

Quote:
string userInfoURL = "https://[base-server-url]/userinfo?" + accessToken;

yet the error message states

Quote:
Received invalid UserInfo request. Access token is not present in the request. The access token needs to be carried in Authorization Request Header Field or Form-Encoded Body Parameter.

so I doubt it's seeing the token .. I would try

WebClient client = new WebClient();
client.Headers.Add(HttpRequestHeader.Authorization, 
    "Bearer " + accessToken);
// Do the download ...

Posted 18-Jul-20 22:31pm

Garth J Lancaster

Comments

Member 10014841 19-Jul-20 5:26am

I requested as per mentioned modification. But still unauthorized(401) error occurs.

//accessToken variable contains access token data
string userInfoURL = "https://[base-server-url]/userinfo;
Uri userInfoUri = new Uri(userInfoURL);
WebClient client = new WebClient();
client.Headers.Add(HttpRequestHeader.Authorization,"Bearer " + accessToken);
byte[] userInfoBytes = webClient.DownloadData(userInfoUri);
string response = Encoding.UTF8.GetString(userInfoBytes);

Garth J Lancaster 19-Jul-20 5:29am

change

byte[] userInfoBytes = webClient.DownloadData(userInfoUri);

to

byte[] userInfoBytes = client.DownloadData(userInfoUri);

Member 10014841 19-Jul-20 5:49am

Sorry about typo error. I meant WebClient instance was used(client).

client.DownloadData(userInfoUri)

Unauthorized 401 error still happens.

Garth J Lancaster 19-Jul-20 8:10am

sorry - (3) also says "UserInfoListener.ParseRequest: Cannot find access token in the request." so if it wont take that as I've suggested, following how it said to do it, I have nothing further I can offer - hopefully someone else has an idea

Member 10014841 19-Jul-20 10:16am

Thank you so much for your advice. At least I could send the request properly with your guidance. Please somebody help me on the unsolved issue..

Wade Bee · Answer 2 · 2020-12-15T10:31:00

Solution 3

I know this is an old post but for posterity:

In my experience when trying to hit the ADFS OIDC userinfo endpoint you need to pass a querystring key value pair (resource=urn:microsoft:userinfo)

Posted 15-Dec-20 10:31am

Wade Bee

Updated 15-Dec-20 10:41am

v3