I have asp.net mvc 5 integrated with Azure Single SignOn but I'm facing an error reply url AADSTS500112 error

Rakesh T. Sasi 0

{"error":"invalid_client","error_description":"AADSTS500112: The reply address 'http://test.edunet.bh/account/testredirect' does not match the reply address 'https://test.edunet.bh/account/testredirect' provided when requesting Authorization code. Trace ID: 20ff6200-fe73-43f9-8500-406476b42a01 Correlation ID: 7d7a03e4-ce2f-45aa-920a-24bf16933bb4 Timestamp: 2024-04-27 16:29:20Z","error_codes":[500112],"timestamp":"2024-04-27 16:29:20Z","trace_id":"20ff6200-fe73-43f9-8500-406476b42a01","correlation_id":"7d7a03e4-ce2f-45aa-920a-24bf16933bb4"}: Unknown error

Shweta Mathur 27,936 Reputation points Microsoft Employee

2024-05-01T07:05:34.3633333+00:00

@Rakesh T. Sasi Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Rakesh T. Sasi 0 Reputation points

2024-05-02T04:21:37.3366667+00:00

Still not solved my issue . Actually I'm facing the issue after sso login response from Microsoft. I configured app registration with https and in my config also with https for redirect url. But still the problem remains same.
Shweta Mathur 27,936 Reputation points Microsoft Employee

2024-05-02T04:49:19.0266667+00:00

@Rakesh T. Sasi

Could you please share the request you are sending to get the authorization code?

Rakesh T. Sasi 0

public void SignIn()

    {

        // Send an OpenID Connect sign-in request.

        if (!Request.IsAuthenticated)

        {

            HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" },

                OpenIdConnectAuthenticationDefaults.AuthenticationType);

        }

    }
public partial class Startup


{

    private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];

    private static string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];

    private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];

    private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];

    private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];

    private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

    public static readonly string Authority = aadInstance + tenantId;

    // This is the resource ID of the AAD Graph API.  We'll need this to request a token to call the Graph API.

    string graphResourceId = "https://graph.windows.net/";

    public void ConfigureAuth(IAppBuilder app)

    {

        ApplicationDbContext db = new ApplicationDbContext();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions());

        app.UseOpenIdConnectAuthentication(

            new OpenIdConnectAuthenticationOptions

            {

                ClientId = clientId,

                Authority = Authority,

                PostLogoutRedirectUri = postLogoutRedirectUri,

               RedirectUri= redirectUri,

                Notifications = new OpenIdConnectAuthenticationNotifications()

                {

                    // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.

                    AuthorizationCodeReceived = (context) =>

                    {

                        var code = context.Code;

                        ClientCredential credential = new ClientCredential(clientId, appKey);

                        string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;

                        AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));

                        return authContext.AcquireTokenByAuthorizationCodeAsync(

                           code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);

                    }

                }

            });

    }

}
 <appSettings>

<add key="webpages:Version" value="3.0.0.0" />

<add key="webpages:Enabled" value="false" />

<add key="ClientValidationEnabled" value="true" />

<add key="UnobtrusiveJavaScriptEnabled" value="true" />

<add key="ida:ClientId" value="removedforsecurityreasons" />

<add key="ida:AADInstance" value="https://login.microsoftonline.com/" />

<add key="ida:ClientSecret" value="removedforsecurityreasons" />

<add key="ida:Domain" value="removedforsecurityreasons" />

<add key="ida:TenantId" value="removedforsecurityresons" />

<add key="ida:RedirectUri" value="https://test.edunet.bh/Account/TestRedirect" />

<add key="ida:PostLogoutRedirectUri" value="https://localhost:44373" />
  </appSettings>

Shweta Mathur 27,936 Reputation points Microsoft Employee

2024-05-03T10:50:05.2033333+00:00

@Rakesh T. Sasi Thanks for sharing the code configuration. Could you also share the redirect URI you added which registering your application in the Azure portal. Also did you add post logout URL in portal as well?
Rakesh T. Sasi 0 Reputation points

2024-05-03T11:08:25.4333333+00:00

The redirect url configured in App registration.

1 answer

Carlos Solís Salazar 16,696 Reputation points MVP

2024-04-29T22:21:06.59+00:00

you are trying to authenticate from 'http://test.edunet.bh/account/testredirect'

and you have set in your app registration the URL 'https://test.edunet.bh/account/testredirect'

Look at that one uses an HTTP page and the other an HTTPS page.

You must use the same URL.

Hope this helps.

Remember accepting the answer if it helps!
Please sign in to rate this answer.
Rakesh T. Sasi 0 Reputation points

2024-05-02T04:17:40.4266667+00:00

In Azure App registration I put https and in my web config also with https only. Actually this was getting after login.
Sign in to comment