RevocationEndpoint not configured

[natelaff]

Affected component

Duende.AccessTokenManagement

Version

3.2.0

Describe the bug

I am experiencing the RevocationEndpoint not configured error. I have found this issue in the archived repo and the soon to be deleted IS4 repro which mentions this page
https://docs.duendesoftware.com/identityserver/v7/troubleshooting/wilson

Following the steps it mentions I do not see a conflict in the package versions.

I am using AccessTokenManagement 3.2.0 and .NET 9

dotnet list package --include-transitive | sls "Microsoft.IdentityModel|System.IdentityModel"

Microsoft.IdentityModel.Abstractions 8.0.1
Microsoft.IdentityModel.JsonWebTokens 8.0.1
Microsoft.IdentityModel.Logging 8.0.1
Microsoft.IdentityModel.Protocols 8.0.1
Microsoft.IdentityModel.Protocols.OpenIdConnect 8.0.1
Microsoft.IdentityModel.Tokens 8.0.1
System.IdentityModel.Tokens.Jwt 8.0.1

I have also tried forcing these packages to update to the latest 8.6.0, with the same results.

Typically I don't reference any package in my client directly (even Microsoft.AspNetCore.Authentication.OpenIdConnect) because I just let it come in from the AccessTokenManagement package.

Any ideas?

Steps to reproduce

.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
{
// automatically revoke refresh token at signout time. This is throwing now.
options.Events.OnSigningOut = async e => { await e.HttpContext.RevokeRefreshTokenAsync(); };
})

Expected behavior

No error? :)

Additional context

No response

[Erwinvandervalk]

Hi,
Thanks for reporting this.

I've tried to reproduce this issue, with the same assemblies, but have been unable to do so. Would you be able to create a minimal reproduction?

[natelaff]

Ok, it appears to be in my IOpenIdConnectConfigurationService

it's trying to get it from

        var config = new OpenIdConnectClientConfiguration
        {
            Scheme = configScheme,

            Authority = options.Authority,
            TokenEndpoint = $"{_configuration["Authentication:BaseAuthority"]}/{tenantName}/connect/token",
            RevocationEndpoint = configuration.AdditionalData.TryGetValue(OidcConstants.Discovery.RevocationEndpoint, out var value) ? value?.ToString() : null,

            ClientId = options.ClientId,
            ClientSecret = options.ClientSecret,
            HttpClient = options.Backchannel,
        };
        return config;

That's pulling null suddenly. Is this supposed to come from IS? Perhaps my IdentityServer project being updated is what caused it?

[RolandGuijt]

Can you please investigate where the configuration object is coming from and what type it is? The one with the AdditionalData property?
OidcConstants.Discovery.RevocationEndpoint is just a constant string: "revocation_endpoint". It looks like AdditionalData is missing the value for that key.

[natelaff]

My AdditionalData only has backchannel_logout_supported and backchannel_logout_session_supported. How many things should be in there? Where should this be coming from. I am getting this object from options.

This is the whole class that accesses this... an awful lot of code to just inject the tenant name into the token endpoint :D

    public class CloudAppOpenIdConnectConfigurationService : IOpenIdConnectConfigurationService
    {
        private readonly IOptions<UserTokenManagementOptions> _userAccessTokenManagementOptions;
        private readonly IOptionsMonitor<OpenIdConnectOptions> _oidcOptionsMonitor;
        private readonly IAuthenticationSchemeProvider _schemeProvider;
        private readonly IMultiTenantContextAccessor<CloudAppTenantInfo> _multiTenantContextAccessor;

        private readonly IConfiguration _configuration;

        public CloudAppOpenIdConnectConfigurationService(
            IOptions<UserTokenManagementOptions> userAccessTokenManagementOptions,
            IOptionsMonitor<OpenIdConnectOptions> oidcOptionsMonitor,
            IAuthenticationSchemeProvider schemeProvider,
            IMultiTenantContextAccessor<CloudAppTenantInfo> multiTenantContextAccessor,
            IConfiguration configuration)
        {
            _userAccessTokenManagementOptions = userAccessTokenManagementOptions;
            _oidcOptionsMonitor = oidcOptionsMonitor;
            _schemeProvider = schemeProvider;
            _multiTenantContextAccessor = multiTenantContextAccessor;
            _configuration = configuration;
        }

        public async Task<OpenIdConnectClientConfiguration> GetOpenIdConnectConfigurationAsync(string? schemeName = null)
        {
            OpenIdConnectOptions options;

            var configScheme = schemeName ?? _userAccessTokenManagementOptions.Value.ChallengeScheme;

            if (string.IsNullOrWhiteSpace(configScheme))
            {
                var defaultScheme = await _schemeProvider.GetDefaultChallengeSchemeAsync();

                if (defaultScheme is null)
                {
                    throw new InvalidOperationException(
                        "No OpenID Connect authentication scheme configured for getting client configuration. Either set the scheme name explicitly or set the default challenge scheme");
                }

                configScheme = defaultScheme.Name;
            }

            options = _oidcOptionsMonitor.Get(configScheme);

            OpenIdConnectConfiguration configuration;
            try
            {
                configuration = await options.ConfigurationManager!.GetConfigurationAsync(default);
            }
            catch (Exception e)
            {
                throw new InvalidOperationException(
                    $"Unable to load OpenID configuration for configured scheme: {e.Message}");
            }

            var tenantName = _multiTenantContextAccessor.MultiTenantContext.TenantInfo?.Name;
            var config = new OpenIdConnectClientConfiguration
            {
                Scheme = configScheme,

                Authority = options.Authority,
                TokenEndpoint = $"{_configuration["Authentication:BaseAuthority"]}/{tenantName}/connect/token",
                RevocationEndpoint = configuration.AdditionalData.TryGetValue(OidcConstants.Discovery.RevocationEndpoint, out var value) ? value?.ToString() : null,

                ClientId = options.ClientId,
                ClientSecret = options.ClientSecret,
                HttpClient = options.Backchannel,
            };
            return config;
        }
    }
    ```

[RolandGuijt]

configuration.AdditionalData is a key-value collection that contains data that is not exposed as strongly typed properties in the OpenIdConnectConfiguration object. Your code is looking for the string "revocation_endpoint" that apparently now is null.
Can you please view the discovery document in the browser and see if you can spot it?
If not the endpoint could be disabled in IdentityServer's config. Can you check that too please?

[natelaff]

Hmm... shoot. It's in there. There must be something new going on down stream with the multi-tenancy stuff I guess? Very strange. I will have to do some digging! Thank you for your insight @RolandGuijt, very helpful!!!

[natelaff]

Ok, so I started digging and looked more, convinced the issue was somewhere when I was calling into GetConfigurationAsync() which was what is loading that discovery document. But even so, all looked correct.

What I found though is that OpenIdConnectCOnfiguration has a RevocationEndpoint (which was properly set). So I just get it from there now, instead of trying to get it from AdditionalData as I was doing before, and everything is back to working!

So, somewhere something changed where that thing is no longer in additionlData but strongly typed? Not sure what package that got updated in or what controls any of that . Presumably the update to Microsoft.IdentityModel.Protocols.OpenIdConnect 8.0.1.

[AndersAbel]

Microsoft.IdentityModel.Protocols.OpenIdConnect puts any properties it does not recognize into AdditionalData. When they added the RevocationEndpoint property they also removed it from the AdditionalData. As far as I can find out/remember this was changed in Microsoft.IdentityModel.Protocols.OpenIdConnect version 8.0.0.