How to solve Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is '[PII is hidden]'?

Question

I almost tried every solution so far for getting out of the problem of following exception.

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is '[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.  
                              at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateNonce(OpenIdConnectProtocolValidationContext validationContext)  
                              at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateAuthenticationResponse(OpenIdConnectProtocolValidationContext validationContext)  
                              at Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationHandler.<AuthenticateCoreAsync>d__11.MoveNext()  

But I am not able to get rid of the above exception.

If I try second time, it works. But for very first time ( at very first attempt ), this does not work at all.

I have Microsoft.Owin.Security.OpenIdConnect latest package installed into .NET application. Mostly using default implementation of Owin middleware hooked up for IIS normal HTTP call.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);  
                app.UseCookieAuthentication(new CookieAuthenticationOptions());                     
  
                app.UseOpenIdConnectAuthentication(  
                    new OpenIdConnectAuthenticationOptions  
                    {  
                        AuthenticationMode = AuthenticationMode.Passive,  
                        ClientId = lClientId.ToString(),  
                        Authority = String.Format(System.Globalization.CultureInfo.InvariantCulture, System.Configuration.ConfigurationManager.AppSettings["Authority"], lTenantId),  
                        RedirectUri = "https://1001apvdp1012.forest7.dom/AHPOneFrontend/ExtAz/",  
  
                        PostLogoutRedirectUri = string.Format(postLogoutRedirectUri, HttpContext.Current.Request.Url.DnsSafeHost),  
  
                        Scope = OpenIdConnectScope.OpenIdProfile,  
                        ResponseType = OpenIdConnectResponseType.IdToken,  
                        TokenValidationParameters = new TokenValidationParameters()  
                        {  
                            ValidateIssuer = true // This is a simplification  
                        },  
                        Notifications = new OpenIdConnectAuthenticationNotifications  
                        {  
                            AuthenticationFailed = OnAuthenticationFailed,  
                            SecurityTokenValidated = OnSecurityTokenValidated,  
                            RedirectToIdentityProvider = OnRedirectToIdentityProvider  
                        }  
                    }  

rest of other values are coming from configuration file.

I am attaching fiddler request flow to demonstrate about the request

Cany any body give me the idea how to get rid of this problem?

Answer 1

Hi @Muhammad Khalil , sorry for the delay in response! Have you tried looking at application gateway diagnostics? it might be able to track down your problem. I was able to find another thread related to this error here: https://social.msdn.microsoft.com/Forums/zh-CN/b5818590-a8d5-4b9b-9f3e-d3b5defef6c8/3719732622242122999231243242073259320851652922151831471app?forum=windowsazurezhchs

However it is in Chinese. Relevant translation:

"The problem was that the time or automatic reference program service binding a custom domain name.

After the application network management is configured. The Host IP that modifies the custom domain name points to a public IP that is gateway."

Please try checking that your domain is configured correctly and points to the correct gateway. Please let me know if this helps.

Best,
James