Trying to set up a duende middleware to host for a .net framework 4.6.2 application

[Toastedcranium]

Basically we have a .net framework 4.6.2 application set up with identityserver 3 and are trying to slowly upgrade to .net 8 and utilize duende.

The first step we are doing is trying to set up a .net 8 duende project to host the authentication and have the current .net framework 4.6.2 project point to that to authenticate the user and have it all handled over there. Eventually we will upgrade the entire project to .net 8 over time.

What I am trying to do is see if I can get anything to happen between the two, see any traffic happening between the .net framework project and the duende project. I haven't quite figured out the correct location of the .net framework project to hook into, we use smartcard authentication and lots of different areas that it could hook up to. I am still doing tests. Last thing I had was

{"IDX10803: Unable to create to obtain configuration from: 'https://localhost:5001/.well-known/openid-configuration'."}

but I could enter that address and see an output of odic.

currently have a client set up on the .net 8 app and the hosting extensions builder:

new Client
{
    ClientId = "dotnet-framework-client",
    ClientSecrets = { new Secret("client-secret".Sha256()) },
    AllowedGrantTypes = GrantTypes.Code,
    RedirectUris = { "http://localhost:5001/signin-oidc" },
    PostLogoutRedirectUris = { "http://localhost:5001/signout-callback-oidc" },
    AllowedScopes = { "openid", "profile" },
    AllowAccessTokensViaBrowser = true,
    AccessTokenLifetime = 3600  // 1 hour
}

//hostingextensions.cs
builder.Services.AddIdentityServer(options =>
{
    options.IssuerUri = "https://localhost:5001";
    options.Events.RaiseErrorEvents = true;
    options.Events.RaiseInformationEvents = true;
    options.Events.RaiseFailureEvents = true;
    options.Events.RaiseSuccessEvents = true;
    options.EmitStaticAudienceClaim = true;
})
.AddInMemoryClients(Clients.GetClients())
.AddInMemoryIdentityResources(GetIdentityResources())
.AddInMemoryApiScopes(GetApiScopes())
.AddDeveloperSigningCredential();

In the .net framework 4.6.2 project I have been trying this in a few different places:

a_appBuilder.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
         {
            ClientId = "dotnet-framework-client",  // The client ID registered in IdentityServer
            ClientSecret = "client-secret",
            Authority = "https://localhost:5001",  // URL of Duende IdentityServer
            RedirectUri = "http://localhost:5001/signin-oidc",
            PostLogoutRedirectUri = "http://localhost:5001/signout-callback-oidc",  // URL to redirect after logout
            Scope = "openid profile",  // Scopes to request
            ResponseType = "id_token token",  // Response type to get ID token and access token
            UseTokenLifetime = false,  // Use IdentityServer token lifetime,
            AuthenticationType = CustomProvidersConstants.SmartCardAuthProviderName,
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
            TokenValidationParameters = new TokenValidationParameters
            {
               ValidateIssuer = true,
               ValidIssuer = "https://localhost:5001",
            },
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
               SecurityTokenValidated = context =>
               {
                  // Handle successful token validation here
                  return Task.CompletedTask;
               },
               AuthenticationFailed = context =>
               {
                  // Handle authentication failure here
                  context.HandleResponse();  // Prevents the default error page
                  context.Response.Redirect("/Error");  // Custom error handling
                  return Task.CompletedTask;
               }
            }
         });

Anyone have any ideas on what I could try?

[maartenba]

Are there any exceptions visible in logs around this message you are seeing?

[Toastedcranium]

We were able to finally get communication between the .net framework app and the duende application. It was essentially having 'offline_access' that was somehow causing it to not work properly. Removing that made it work.

Now we are having issues with the JWKS keys. The .net framework application is expecting an x5c entry in the jwks, but it is not there. Is there a way to add that in somehow? I have been trying lots of different options and looking through all the documentation and cannot seem to find anything.

[maartenba]

How are the JWKS created/generated/registered? The JWK JSON you register as a Secret should contain the x5c property when registered with IdentityServer if you need it on the client/API side.

[maartenba]

@Toastedcranium I see you closed the discussion, I'm curious what the issue was in the end?