Where communities thrive

  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
Repo info
    Hello everyone, I'm working on ids4 and I need to add custom user claims from another data source like API. Anyone has an idea?
    Cody Rees

    @alqadri-prog You could try adding a custom ProfileService

    public class MyProfileService : IProfileService {
        public MyProfileService( ... ) {
        public async Task GetProfileDataAsync(ProfileDataRequestContext context) {
            // Get user / subject id 
            var subject = context.Subject.GetSubjectId();
            var user = myDataService.getUser( subject ); 
            if( user != null ) { 
                // Query your api service
                var claims = await myAPIService.fetchClaims( subject )
                // Set claims
                context.IssuedClaims = claims
        public async Task IsActiveAsync(IsActiveContext context) {
            var subject = context.Subject.GetSubjectId();
            var user = myDataService.getUser( subject ); 
            context.IsActive = user != null;

    Then in your startup

    Ahmed Badawi

    Hello all
    i have an issue related to admin ui on docker environment using ngnix
    on redirection to /signin-oidc atfer login auth is successffull
    any idea ?

    AuthenticationScheme: Cookies signed in.
    [15:14:59 INF] Request finished HTTP/1.0 POST http://{ip}/signin-oidc application/x-www-form-urlencoded 590 - 302 0 - 540.6799ms
    [15:14:59 DBG] Connection id "0HMHS0NA62L58" disconnecting.
    [15:14:59 DBG] Connection id "0HMHS0NA62L58" stopped.
    [15:14:59 DBG] Connection id "0HMHS0NA62L58" sending FIN because: "The Socket transport's send loop completed gracefully."
    [15:15:01 DBG] Connection id "0HMHS0NA62L59" accepted.
    [15:15:01 DBG] Connection id "0HMHS0NA62L59" started.
    [15:15:01 INF] Request starting HTTP/1.0 GET http://{ip}/signin-oidc - -
    [15:15:01 DBG] The request path /signin-oidc does not match a supported file type
    [15:15:01 DBG] No candidates found for the request path '/signin-oidc'
    [15:15:01 DBG] Request did not match any endpoints
    [15:15:01 WRN] .AspNetCore.Correlation. state property not found.
    [15:15:01 INF] Error from RemoteAuthentication: Correlation failed..
    [15:15:01 ERR] An unhandled exception has occurred while executing the request.
    System.Exception: An error was encountered while handling the remote login.
    ---> System.Exception: Correlation failed.
    --- End of inner exception stack trace ---
    at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
    at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
    at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
    at NWebsec.AspNetCore.Middleware.Middleware.CspMiddleware.Invoke(HttpContext context)
    at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
    at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
    at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
    at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
    at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
    [15:15:01 INF] Request finished HTTP/1.0 GET http://{ip}/signin-oidc - - - 500 - text/html;+charset=utf-8 38.5731ms
    [15:15:01 DBG] Connection id "0HMHS0NA62L59" disconnecting.
    [15:15:01 DBG] Connection id "0HMHS0NA62L59" stopped.
    [15:15:01 DBG] Connection id "0HMHS0NA62L59" sending FIN because: "The Socket transport's send loop completed gracefully."


    Good day. I set up my Identity client to make a request to Signout endpoint (It's called "front channel logout" in identity terms) after logging out from Identity app.

    The request contains sid(session id) and iss (request initiator). Example: /api/sso-signout?sid=kR7iyKn1DMJOBPAlP3U8Mw&iss=https://identity.dev.com/login

    The problem is that we do Signout thru HttpContext, but we do not have the required context to do the logout as the request is done from different domain(Identity in this case), and user has another httpContext in our application(in a nutshell: when we do the Signout request from identity we have no clue who to signout on a server)

    Paul McNamara
    @PavelKochkin2 probably best to use back channel logout in that situation
    Then you can trigger it in any context and not be reliant on it being a browser-based user interaction
    it also gets around the strict third party cookie problem which renders front channel useless if using multiple domains
    It works well but relies on a bit more work being done by the client - i.e. manipulating backend session storage or maintaining a session ID blacklist
    Hi Guys, i am new here. this might have been brought up here already but I am struggling with this logout action.
    I have IdentityServer4 .net core app and have a .net 6 MVC client trying to logout
    this is my client
    new Client
    ClientId = "localc3tools",
    ClientName = "Local C3 Tools",
    ClientSecrets = { new Secret(Constants.Current.C3ToolsClientSecret.Sha256()) },
    RequireConsent = false,
    RequirePkce = false,
    IdentityTokenLifetime = 300,
    AccessTokenLifetime = 3600,
    AllowedGrantTypes = GrantTypes.Hybrid,
    AllowOfflineAccess = true,
    RefreshTokenUsage = TokenUsage.OneTimeOnly,
    AllowAccessTokensViaBrowser = true,
    AlwaysSendClientClaims = true,
    Enabled = true,
    AllowedScopes = {
    RedirectUris = new List<string>
    Constants.Current.LocalC3ToolsClient + "/signin-oidc"
    PostLogoutRedirectUris = new List<string>
    Constants.Current.LocalC3ToolsClient + "/signout-callback-oidc"
    FrontChannelLogoutUri = Constants.Current.LocalC3ToolsClient + "/signout-callback-oidc"
    logout method in IdentityServer4 app
        public async Task<IActionResult> Logout(LogoutInputModel model)
            // build a model so the logged out page knows what to display
            var vm = await new AccountHelper(_interaction, _clientStore).BuildLoggedOutViewModelAsync(model.LogoutId);
            if (User?.Identity.IsAuthenticated == true)
                // delete local authentication cookie
                await HttpContext.SignOutAsync();
            return View("LoggedOut", vm);
    just trying to hit it from my mvcclient app
    i have tried different stuff but here is my logout method in my mvcclient app
        public async Task Logout()
                await HttpContext.SignOutAsync();
                //var client = new HttpClient();
                //var tokenResponse = await HttpContext.GetTokenAsync("access_token");
                //client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", tokenResponse);
                //var url = _appSettings.IdentityServerUri + "Account/Logout";
                //string param = $"LogoutId={tokenResponse}";
                ////HttpContent content = new StringContent(param, Encoding.UTF8, "application/json");
                //var response = client.GetAsync(url+param);
            catch (Exception e)
    thanks in advance
    Paul McNamara
    For logout you need to just redirect to the end_session_endpoint defined in the discovery doc
    I forget exactly what the standard middleware does but it may handle it for you
    The actual URL by default will be https://{IDP}/connect/endsession
    Mehdi Payervand
    Hi everbody
    I want to send OTP that will be compare in LoginWith2fa action in email, How can I access or generate it?
    Mehdi Payervand
    or to send it via SMS
    Diego Bustamante
    :question: opinion poll: what's going to be a better alternative to id4server -> A) Azure AAD B2C or B) Keycloak ?
    Kevin Kallberg
    I have a fairly heavy SPA that I am securing with IdentityServer4. Let's say I have app.mydomain.com serving the SPA and identity.mydomain.com is where IdentityServer4 lives. Currently we encourage users to navigate to apps.mydomain.com, where the SPA is loaded, then once loaded the user is redirected to identity.mydomain.com for interactive login. Upon successful login, the user is then redirected back to the SPA at apps.mydomain.com, where they have to wait for the application to load a second time. I'm looking for a way to get out of loading the SPA twice. One thought we had was to instead encourage users to begin at identity.mydomain.com, skipping the first SPA load. However, upon successful login, what now? The user needs the token to access the SPA. What are we overlooking? This seems like it should be doable. Any suggestions would be much appreciated. Thanks!
    Cody Rees

    @kkallberg I'm not too sure what tech stacks your using but assuming you're using React / Angular / Next or something like that you could have a few options. Although without knowing exactly what your production environment is like some of these may not apply.

    I'd say possibly the easiest method would be to bundle a second piece of javascript along with your SPA that runs parallel to your app. This piece would solely be responsible for checking the request URI for a token and redirecting away to the identity server if it doesn't exist. This would allow you to pre-fire the redirect even before your SPA is loaded. Then when you're redirected back, your app will load as normal.

    You could also reduce the number of redirects by using silent auth and storing the renewal token in a cookie (Maybe someone else could comment on the security of using this token this way).

    Another solution is to do the same above but at a server level. Without knowing what server you're using to serve the SPA it's hard to give any exact instructions but if your spa is served using nginx / apache you could configure your htaccess/.conf files to do the same behavior as above. Check the URL for the token parameter, if it doesn't exist (or a renewal cookie for silent auth doesn't exist), redirect to identity server first. If your server doesn't support either of these technologies, you could achieve the same results using a nginx based reverse proxy or possibly even writing a custom solution for whatever server you're using.

    Good luck!

    Hi, running into an issue for an internal application that is using "Azure App Proxy" to route working from home users to the internally facing website whereby IdentityServer4 is issuing the tokens. Internally everything works as expected however externally when authenticating I can see a Authorization token is created however the connect/userinfo endpoint responds with a 403 and the Logs have written "No Access Token Found" Any suggestions would be much appreciated. Thanks!
    Riccardo Becker
    hi all, is there a way to show a <img src="path to external image on public blob storage"...> from an external on the login page?
    Kaustav Chakraborty
    When I am using password grant type how to have userid as a claim in the generated JWT token ?
    Hello, I'm getting the error " Cookie was not authenticated. Failure message: Unprotected ticket failure" this is happening under load balanced traffic with Identity being split in Authentication/Authorization service and User management service. This error occurs on the management service on the authentication process. Is this a data protection issue? Is there an example how to configure this having two services, in case this would be the issue ?
    Robert Karlsson
    @florin86:matrix.org its a data protection issue, you are using different keys on your different instances. You need to use a distributed store for your keys
    Navid Shokri
    @florin86:matrix.org this is the link that I used to cluster my identityserver https://github.com/IdentityServer/IdentityServer4/issues/2205#issuecomment-424253606
    Anand Jaisy

    In the development mode, the client Angular application is running on HTTP. After successfully logging
    when redirect back to the application it keeps reloading again. This is because of HTTP, however, if I change the Node
    application to the HTTPS everything is working. Does anyone know how to allow HTTP

    I have setup CORS as well


    And in the client setting the allowed CORS are as below

    Chihab HAJJI
    does someone have a minimal demo with two legged OAuth (2LO) please ?
    we have SPA application on react using oidc-client js and Identity server 4. the issue here is to implement session idling, e.g. if user is idle for 2hr then application should log out. we have autoslient = true on oidc client side and identity server 4 using SlidingRefreshTokenLifetime but we are not sure how to achive session idling but max session works for us as we have absoluteRefreshtokenLifeTime set..
    Tuncay Cem Uzun
    the project runs smoothly on local but when I work with Docker 'admin-api.skoruba.local' returns 404. What is the problem?
    Edin Jašarević
    Hi everyone!
    Abdallah Hassnat
    Hi everyone!
    Cody Rees
    @sharonmary:matrix.org everyone here is a security nerd. You're fishing in the wrong pond mate.
    using Duende identityServer with AspNet core identity authentication and serverSide session. We have a client using the duende BFF and are trying to get sliding expiration to work. The server session table doesn't seem to update "renew" when refreshing the client page. sliding is set on BFF side and IdentityServer side. How does BFF inform IdentityServer to renew the session. If we log directly into the identity server, sliding works fine
    I want to have a password/username login and fingerprint login in identity server but i don't know how to do it can you help me?

    Having issues with Sliding cookies with identityServer. Lets say we have authentication cookie set to expire on identityserver at 1 hour - sliding = true. A client application that uses IdentityServer has an auth cookie is set to 30 minutes, sliding = true. The client application can slide it's cookie every > 15 minutes keeping the user logged in on the client application. However that does not sync back on identityServer side. After 1 hour the session there is effectively ended regardless of the client's sliding. The client will continue to work until it's cookie expires > 30 minutes if no sliding there happens..

    The only time a slide on identityserver seems to happen is when the client cookie expires BEFORE the identityserver cookie. In that case, the client logs back in a again, a call to authorize, slides the identityserver cookie. Maybe thinking about this wrong, but expected that when a client cookie slides, this also calls to identityserver to slide that cookie as well (if > 1/2 the expry time).

    Dane Watson
    Hello. newbie question. Asp.net 6, IDS4, with an MVC webapp. I want to have oidc do the authentication, but I want the MVC application to have ApplicationUser available for every page in context. Which example should I look at?
    1 reply
    Terje Sandstrom
    I'm upgrading from earlier versions of IdentityModel, and cant find out where the "AddUserAccessTokenClient" method has gone. Also looks like "IdentityModel.AspNetCore" has been archieved - what is supposed to replace that one ?
    1 reply
    Win up to $1000 in crypto trading when you invest with just the minimum of $100.
    Signup and start investing your crypto with.
    Hi I wondered if anyone can point me in the right direction... I'm trying to run Ids4 in kubernetes but I'm struggling to get the discovery document to have the external urls display rather than the internal ones, and also same issue with https if I have my SSL managed on the gateway ingress controller (agic).
    Hi All, We are using IdentityServer4 , Cert-manager, Kubernetes setup. When using IdentityServer4 admin page we get this error. "unable to obtain configuration from well-known/openid-configuration". We do not get the same error on other pages but only on Identity4 admin. Anybody has faced same issue?