Unable to Authenticate - Azure web app with Azure Active Directory (OpenIdConnect)

Question

Unable to Authenticate - Azure web app with Azure Active Directory (OpenIdConnect)

Prabakaran Rajendran 1

Dear Team,

When i tried to login with Azure AAD. i received an error message as 'We couldn't sign you in. Please try again'. Once i restart the azure webapp i can able to login successfully and it works for few hours then again started failing and not able to login.

URL : https://login.microsoftonline.com/TENANTID/oauth2/authorize?client_id=CLIENTID&redirect_uri=URL&response_mode=form_post&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3TOKEN&nonce=123456789sddfeqwfd&x-client-SKU=ID_NET451&x-client-ver=5.3.0.0

Seek your assistance on this exception.

Thank you.

**alt text**

alt text

soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2019-12-30T09:19:42.283+00:00
@Prabakaran Rajendran , Thank you for reaching out.

Based on the details shared, since this app starts working after a restart, that clears that fact that sometimes the app is able to reachout to AAD and get the user authentication done successfully. To figure out the reason for it failing sometime, we would need to have a deeper understanding of the scenario like:

What kind of domain is the user trying to login is a part of? (Federated or Managed domain)

What does the Signin logs in Azure AD say regarding this application's login attempt?

Do share the following details and we can check on that based on the details provided. Also it would be great if you can collect a Fiddler trace (https://www.telerik.com/download/fiddler) and capture a trace while the user is trying to login and share the same with us on azcommunity@microsoft.com
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2019-12-30T09:20:59.197+00:00
@Prabakaran Rajendran ,

While sharing the fiddler trace, please do share the following details too:

App Service Name

Date and Time when the issue happened or the time you restarted the App Service

App ID (App ID for the registered application in Azure AD for the corresponding Web App)

User UPN with which this WebApp login was tested.

You can also use the following URL to configure the Fiddler trace to make sure that Fiddler is able to capture the decrypted HTTPS traffic: https://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS

When you drop us an email on azcommunity@microsoft.com, please make sure you share the reference of this QnA thread so that its easier for us to help you.
Prabakaran Rajendran 1 Reputation point

2020-01-01T05:24:09.907+00:00

@soumi-MSFT ,

Thanks for the reply. I've emailed the details as requested to azcommunity@microsoft.com .

Seek your reply. Thank you!
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2020-01-01T09:44:15.827+00:00

@Prabakaran Rajendran , I checked my inbox, but somehow that email was not there. Can you just try once again sending the same email to "AzCommunity@microsoft.com" and also cc "souravmishra-msft@harsh.com .com".

I am not sure if you are sending the fiddler trace in that email and if that is getting filtered. In case the second attempt also fails, then please do share your email ID with us on my email ID, so that we can take this up on that email thread.
Prabakaran Rajendran 1 Reputation point

2020-01-02T01:55:34.55+00:00

@soumi-MSFT ,

I resend the email to you. Please check your inbox and confirm

Thank you.
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2020-01-02T04:10:49.427+00:00

@Prabakaran Rajendran , Yups I received the email this time.

Allow us some time to check the details and will get back to you soon on this thread.
Prabakaran Rajendran 1 Reputation point

2020-01-02T08:12:27.847+00:00

@soumi-MSFT , Thanks for confirming.

Looking forward to your reply.

3 answers

Your answer

soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2019-12-30T09:19:42.283+00:00

@Prabakaran Rajendran , Thank you for reaching out.

Based on the details shared, since this app starts working after a restart, that clears that fact that sometimes the app is able to reachout to AAD and get the user authentication done successfully. To figure out the reason for it failing sometime, we would need to have a deeper understanding of the scenario like:

What kind of domain is the user trying to login is a part of? (Federated or Managed domain)

What does the Signin logs in Azure AD say regarding this application's login attempt?

Do share the following details and we can check on that based on the details provided. Also it would be great if you can collect a Fiddler trace (https://www.telerik.com/download/fiddler) and capture a trace while the user is trying to login and share the same with us on azcommunity@microsoft.com
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2019-12-30T09:20:59.197+00:00

@Prabakaran Rajendran ,

While sharing the fiddler trace, please do share the following details too:

App Service Name

Date and Time when the issue happened or the time you restarted the App Service

App ID (App ID for the registered application in Azure AD for the corresponding Web App)

User UPN with which this WebApp login was tested.

You can also use the following URL to configure the Fiddler trace to make sure that Fiddler is able to capture the decrypted HTTPS traffic: https://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS

When you drop us an email on azcommunity@microsoft.com, please make sure you share the reference of this QnA thread so that its easier for us to help you.
Prabakaran Rajendran 1 Reputation point

2020-01-01T05:24:09.907+00:00

@soumi-MSFT ,

Thanks for the reply. I've emailed the details as requested to azcommunity@microsoft.com .

Seek your reply. Thank you!
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2020-01-01T09:44:15.827+00:00

@Prabakaran Rajendran , I checked my inbox, but somehow that email was not there. Can you just try once again sending the same email to "AzCommunity@microsoft.com" and also cc "souravmishra-msft@harsh.com .com".

I am not sure if you are sending the fiddler trace in that email and if that is getting filtered. In case the second attempt also fails, then please do share your email ID with us on my email ID, so that we can take this up on that email thread.
Prabakaran Rajendran 1 Reputation point

2020-01-02T01:55:34.55+00:00

@soumi-MSFT ,

I resend the email to you. Please check your inbox and confirm

Thank you.
soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2020-01-02T04:10:49.427+00:00

@Prabakaran Rajendran , Yups I received the email this time.

Allow us some time to check the details and will get back to you soon on this thread.
Prabakaran Rajendran 1 Reputation point

2020-01-02T08:12:27.847+00:00

@soumi-MSFT , Thanks for confirming.

Looking forward to your reply.

Answer 1

Rizwan Mahfooz 6

I faced the same issue, I opened a ticket with Microsoft and here is the solution that resolved the problem. Thanks

https://dotnetcodetips.com/Tip/91/Azure-OWIN-website-login-gets-stuck-on-a-never-ending-redirect-loop

Shubham Agrahari 1 Reputation point

2020-06-29T18:19:10.43+00:00

Thanks for this solution Rizwan.

Earlier i was using - CookieManager = new Microsoft.Owin.Host.SystemWeb.SystemWebChunkingCookieManager()
and now i tried with your given code chunk - CookieManager = new SystemWebCookieManager()
But still facing issue after entering User ID and Cred again redirection of index page is going into infinite loop.
and then finally this error - We couldn't sign you in. Please try again.
Rizwan Mahfooz 6 Reputation points

2020-06-29T20:51:52.143+00:00

Can you check application Authentication logs. Also, try this in private browser to make sure that application is using the correct User ID.

Also, please make sure user has permissions to authenticate the app. Hope that works. Thanks

Answer 2

Marilee Turscak-MSFT 37,206 Microsoft Employee Moderator

Please follow up with the resolution to this thread once you have gone through the trace logs. Also, you may want to try changing browsers to see if you can authenticate through a different browser. I have heard of this happening with Safari, for instance, before.

Prabakaran Rajendran 1 Reputation point

2020-01-04T02:41:12.173+00:00

@MarileeTurscak ,

I am looking forward for the resolution. Actually i have tried with chrome, safari and Microsoft edge but all end up with the same problem.

Seek your help to resolve this issue. Thanks.
Rizwan Mahfooz 6 Reputation points

2020-03-09T09:28:32.847+00:00

Hi @Prabakaran Rajendran , @MarileeTurscak

I'm also facing the same issue. Can you please let me know if you have fixed the issue. Thanks

looking forward to hearing from you soon.

Thanks
Rizwan
Virginia Rochester 1 Reputation point

2020-03-13T09:03:58.097+00:00

I am also having this problem. Is there any resolution yet?

Answer 3

Shubham Agrahari 1

Hi @soumi-MSFT, @rajpraba, I am also facing the same issue..If the issue got resolved then please post the answer.

Share via

Unable to Authenticate - Azure web app with Azure Active Directory (OpenIdConnect)

3 answers

Your answer