Azure SSO - Response status code does not indicate success: 426 (InvalidRequest).

Question

Server Error in '/azuressotest' Application.
Response status code does not indicate success: 426 (InvalidRequest).
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Net.Http.HttpRequestException: Response status code does not indicate success: 426 (InvalidRequest).
Azure SSO,OpenId, Authentication,Account sign, MS login
Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[HttpRequestException: Response status code does not indicate success: 426 (InvalidRequest).]
   System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode() +121834
   Microsoft.IdentityModel.Protocols.<GetDocumentAsync>d__0.MoveNext() +399

[IOException: Unable to get document from: https://login.microsoftonline.com/******5/federationmetadata/2007-06/federationmetadata.xml?appid=****]
   Microsoft.IdentityModel.Protocols.<GetDocumentAsync>d__0.MoveNext() +725
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.IdentityModel.Protocols.<GetAsync>d__1.MoveNext() +414
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.IdentityModel.Protocols.<GetConfigurationAsync>d__3.MoveNext() +908

[InvalidOperationException: IDX10803: Unable to create to obtain configuration from: 'https://login.microsoftonline.com/1426******/federationmetadata/2007-06/federationmetadata.xml?appid=d91b1af3*****.]
   Microsoft.IdentityModel.Protocols.<GetConfigurationAsync>d__3.MoveNext() +1255
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Security.WsFederation.<ApplyResponseChallengeAsync>d__c.MoveNext() +522
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Security.Infrastructure.<ApplyResponseCoreAsync>d__8.MoveNext() +376
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Security.Infrastructure.<TeardownAsync>d__5.MoveNext() +215
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Security.Infrastructure.<Invoke>d__0.MoveNext() +968
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<RunApp>d__5.MoveNext() +197
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Security.Infrastructure.<Invoke>d__0.MoveNext() +768
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<RunApp>d__5.MoveNext() +197
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<DoFinalWork>d__2.MoveNext() +184
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult ar) +117
   System.Web.AsyncEventExecutionStep.InvokeEndHandler(IAsyncResult ar) +209
   System.Web.AsyncEventExecutionStep.OnAsyncEventCompletion(IAsyncResult ar) +156

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.7.3930.0

Answer 1

I finally figured out solution

I explicitly only allowing TLS1.2 for MS login

so that Web server don't have to change their security setting as long as it has TLS1.2 enable on their Windows Servers

Answer 2

additionally, this same solution works well for one client (different Windows server - 2012)

have above error for all other clients (Windows Server 2019)

Not sure it's network issue or Windows server security setting issue

Can anybody give suggestion what change is required

thank you so much

Denny

Answer 3

Hi,

I am getting the same error, earlier it was working properly but after 31 May 2023 , It stopped working. Do we have any logs or any track what changed or how to fix it ?

Answer 4

We have run into this yesterday. Appears TLS 1.1 is no longer accepted by federation meta data url. You must use TLS 1.2

Ie. add the following to your code (this allows backward compatibility with 1.1)

System.Net.ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;