59462 OIDC par failure #61947

bigred8982 · 2025-05-14T22:32:16Z

Add OIDC event to allow caller to react to OIDC PAR failure during challenge phase

Description

Add new OIDC OnPushAuthorizationFailed, new context for this event, logic to fire event, tests.

Problem

When a validation failure occurs during a PAR request (ex. the request includes an invalid client_id), an OpenIdConnectProtocolException is thrown. This exception bubbles up as an unhandled middleware exception.

Please see issue #59462 for slightly more details.

Goal

We need to give the application the ability to handle the response when a PAR request fails during the challenge phase. Since an exception during the challenge phase bubbles up as a middleware exception, it is difficult for the application to respond. By including a specific OIDC event, the application has the opportunity to redirect the browser to a user-friendly error page.

Example of a web app utilizing this new feature

builder.Services.AddAuthentication(...)
  .AddOpenIdConnect("oidc", options => 
  {
    ...
    options.Events.OnPushAuthorizationFailed = (ctx) => {
        var logger = ctx.HttpContext.RequestServices.GetRequiredService<ILogger<Program>>();
        logger.LogError(ctx.Exception, "Received error while sending PAR request.");
        
        ctx.Response.Redirect("FriendlyErrorPage");
        ctx.Handled = true;
        return Task.CompletedTask;
    };
  });

Fixes #59462

bigred8982 · 2025-05-14T22:34:24Z

@dotnet-policy-service agree company="Tyler Technologies"

bigred8982 · 2025-05-14T22:37:36Z

Would love feedback from @josephdecock

Also, I'm not sure if this should go into main, but I'd like to see it show up in at least the 10.0 release (it's probably too late to get it into 9).

bigred8982 · 2025-05-22T21:06:55Z

If there anything else I need to do process-wise to make this PR ready for review, please let me know. This is my first contribution and I might have accidentally missed a step.

dotnet-policy-service · 2025-06-04T22:24:23Z

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

bigred8982 · 2025-06-24T21:28:29Z

/azp run

azure-pipelines · 2025-06-24T21:28:35Z

Commenter does not have sufficient privileges for PR 61947 in repo dotnet/aspnetcore

Copilot

Pull Request Overview

This PR adds a new OIDC event OnPushAuthorizationFailed to handle PAR (Pushed Authorization Request) failures during the challenge phase. When a PAR request fails with an exception, applications can now handle the response gracefully instead of receiving an unhandled middleware exception.

Key changes:

New PushedAuthorizationFailedContext class to provide context for PAR failures
New OnPushAuthorizationFailed event in OpenIdConnectEvents
Exception handling logic in OpenIdConnectHandler to catch PAR failures and fire the event
Test coverage for the new failure handling functionality

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`OpenIdConnectChallengeTests.cs`	Adds test to verify PAR failure event handling works correctly
`PublicAPI.Unshipped.txt`	Exposes new public API members for the failure context and event
`OpenIdConnectHandler.cs`	Wraps PAR logic in try-catch to fire failure event when exceptions occur
`LoggingExtensions.cs`	Adds logging for handled PAR failure responses
`PushedAuthorizationFailedContext.cs`	New context class providing exception details and handled flag
`OpenIdConnectEvents.cs`	Adds the new failure event to the events collection

_{You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}

src/Security/Authentication/OpenIdConnect/src/Events/PushedAuthorizationFailedContext.cs

Copilot · 2025-08-13T17:32:52Z

src/Security/Authentication/OpenIdConnect/src/LoggingExtensions.cs

@@ -74,7 +74,7 @@ internal static partial class LoggingExtensions
    [LoggerMessage(37, LogLevel.Debug, "The UserInformationReceived event returned Skipped.", EventName = "UserInformationReceivedSkipped")]
    public static partial void UserInformationReceivedSkipped(this ILogger logger);

-    [LoggerMessage(57, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]
+    [LoggerMessage(60, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]


The event ID was changed from 57 to 60, but this appears to be an existing log message that should maintain its original ID. This change could break logging consistency and any code that depends on the specific event ID.

Suggested change

[LoggerMessage(60, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]

[LoggerMessage(57, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]

There were two values set for 57, which I assumed to be a mistake from a previous commit. I updated this to be the next unique number at the time. I am not sure if that was the correct move.

src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs

…horizationFailedContext.cs Co-authored-by: Copilot <[email protected]>

josephdecock · 2025-09-04T03:41:38Z

Sorry for a hugely delayed response on this thread!

I really like this idea and the PR. It's good that if the error isn't handled, the exception still bubbles up, but if you want to handle it you can. I think this approach of a separate event for pushed authorization is also the best thing to do, because the existing AuthenticationFailed event would happen at a very different point in the protocol interaction. All in all, I think this is a great improvement, and I hope it lands in .NET 10.

src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs

…dler.cs

bigred8982 · 2025-09-04T14:12:48Z

@halter73 Got feedback and a thumbs up from an expert! Is there anything I can do on my end to help get this through?

bigred8982 added 2 commits May 14, 2025 14:23

Add event to allow caller to handle OIDC PAR failure.

286bbeb

Include test for OnPuthAuthorizationFailed event

15e29f9

bigred8982 requested a review from halter73 as a code owner May 14, 2025 22:32

github-actions bot added the area-auth Includes: Authn, Authz, OAuth, OIDC, Bearer label May 14, 2025

dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label May 14, 2025

bigred8982 marked this pull request as draft May 14, 2025 22:55

bigred8982 and others added 2 commits May 14, 2025 17:03

Fix broken build due to copy/paste error

1bd8045

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

e1a07f9

bigred8982 marked this pull request as ready for review May 15, 2025 15:22

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

d701189

dotnet-policy-service bot added the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label Jun 4, 2025

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

b19473d

bigred8982 changed the title ~~Bigred8982/issue 59462 OIDC par failure~~ 59462 OIDC par failure Jun 12, 2025

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

cdb14a4

bigred8982 added 2 commits June 24, 2025 15:28

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

c6065ad

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

b743fc0

Copilot AI review requested due to automatic review settings August 13, 2025 17:32

Copilot AI reviewed Aug 13, 2025

View reviewed changes

bigred8982 and others added 2 commits August 13, 2025 11:33

Update src/Security/Authentication/OpenIdConnect/src/Events/PushedAut…

8840008

…horizationFailedContext.cs Co-authored-by: Copilot <[email protected]>

Merge branch 'dotnet:main' into bigred8982/issue_59462_oidc-par-failure

4bd20fe

bigred8982 commented Sep 4, 2025

View reviewed changes

src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs Outdated Show resolved Hide resolved

Update src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHan…

b39968c

…dler.cs

This was referenced Sep 4, 2025

Known Build Error: error : Cannot create a file when that file already exists. #61178

Open

Sometimes the helix SDK uses GetWorkItemsAsync when workitems aren't done processing. dotnet/dnceng#6011

Open

bigred8982 mentioned this pull request Sep 5, 2025

Add new event to OpenIdConnectEvents to handle specific error scenario #63566

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

59462 OIDC par failure #61947

59462 OIDC par failure #61947

bigred8982 commented May 14, 2025

Uh oh!

bigred8982 commented May 14, 2025

Uh oh!

bigred8982 commented May 14, 2025

Uh oh!

bigred8982 commented May 22, 2025

Uh oh!

dotnet-policy-service bot commented Jun 4, 2025

Uh oh!

bigred8982 commented Jun 24, 2025

Uh oh!

azure-pipelines bot commented Jun 24, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Aug 13, 2025

Uh oh!

bigred8982 Aug 13, 2025

Uh oh!

Uh oh!

josephdecock commented Sep 4, 2025

Uh oh!

Uh oh!

bigred8982 commented Sep 4, 2025

Uh oh!

Uh oh!

	[LoggerMessage(60, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]
	[LoggerMessage(57, LogLevel.Debug, "The PushAuthorization event handled client authentication", EventName = "PushAuthorizationHandledClientAuthentication")]

59462 OIDC par failure #61947

Are you sure you want to change the base?

59462 OIDC par failure #61947

Conversation

bigred8982 commented May 14, 2025

Add OIDC event to allow caller to react to OIDC PAR failure during challenge phase

Description

Problem

Goal

Example of a web app utilizing this new feature

Uh oh!

bigred8982 commented May 14, 2025

Uh oh!

bigred8982 commented May 14, 2025

Uh oh!

bigred8982 commented May 22, 2025

Uh oh!

dotnet-policy-service bot commented Jun 4, 2025

Uh oh!

bigred8982 commented Jun 24, 2025

Uh oh!

azure-pipelines bot commented Jun 24, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

bigred8982 Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

josephdecock commented Sep 4, 2025

Uh oh!

Uh oh!

bigred8982 commented Sep 4, 2025

Uh oh!

Uh oh!