[Bug] MSAL on Blazor WebAssembly fails to initiate sign-in when an invalid_grant or AADSTS700081 error occurs--as in when the refresh token is expired.
See original GitHub issueWhich Version of MSAL are you using ? Microsoft.AspNetCore.Components.Authorization 5.0.0 Microsoft.Authentication.WebAssembly.Msal 5.0.0 Microsoft.AspNetCore.Identity 2.2.0
Platform Blazor WebAssembly on .NET 5.0
What authentication flow has the issue?
- Web App - Authorization code
Is this a new or existing app? The app is in production, and I have upgraded to a new version of MSAL
Repro My MSAL on the client is configured as:
builder.Services.AddMsalAuthentication(options =>
{
builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
options.ProviderOptions.Cache.CacheLocation = "localStorage";
options.ProviderOptions.DefaultAccessTokenScopes.Add(
builder.Configuration["AzureAd:MyScopeId"]);
options.UserOptions.RoleClaim = "roles";
});
I sign in to my Blazor Web Assembly app, then wait till my refresh token expires (for me, 1 day). Then I try to refresh the page, which includes a component like this:
<AuthorizeView>
<Authorized>
<span>@context.User.UserId()</span>
</Authorized>
<Authorizing>
Authorizing
</Authorizing>
</AuthorizeView>
Expected behavior
The page should show “Authorizing”, then the code in MSAL that AuthorizeView triggers should automatically initiate a redirect to sign-in, so that the user can go through authentication and thus get a new refresh token and ID token. (Once signed in, the user should redirect back to the same page, which should show the content within the <Authorized>
fragment.)
Actual behavior
The page shows “Authorizing”, and the HTTP request POST https://login.microsoftonline.com/0c33cce8-883c-4ba5-b615-34a6e2b8ff38/oauth2/v2.0/token
returns HTTP 400 with
error "invalid_grant"
error_description "AADSTS700081: The refresh token has expired due to maximum lifetime. The token was issued on 2020-11-24T12:56:15.5198672+00:00 and the maximum allowed lifetime for this application is 1.00:00:00.\r\nTrace ID: c4360626-5489-4009-89ad-5ae02bd0ca00\r\nCorrelation ID: 228a7671-3752-4ca9-bf1f-7c0c51368fb6\r\nTimestamp:
Then Blazor allows an exception to be thrown with Microsoft.AspNetCore.Components.WebAssembly.Rendering.WebAssemblyRenderer[100] Unhandled exception rendering component: login_required: AADSTS50058: A silent sign-in request was sent but no user is signed in.
and further detail. The error is written to the browser console and Blazor shows the standard “An unhandled error has occurred. Reload” bottom banner.`
Possible Solution Isn’t there some way to configure MSAL to initiate the interactive sign-in process on invalid_grant, rather than having it fail fatally? Or is this just a big bug?
This seems to be similar to: https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/2219 , though I am not using MSAL.js.
Additional context/ Logs / Screenshots Here’s the end of the stack trace: https://gist.github.com/szalapski/942baf9b8da7b5bdb68ebd7f9e2f5544
Issue Analytics
- State:
- Created 3 years ago
- Comments:7 (4 by maintainers)
@jmprieur we are looking at this on the ASP.NET Core repo, you can close the issue here.
Maybe you want to repost to the aspnet core repo to speed up