AccessDenied page returns 404 when using MapControllerRoute

[ElijahSink]

Microsoft.Identity.Web Library

Microsoft.Identity.Web.UI

Microsoft.Identity.Web version

2.5.0

Web app

Sign-in users

Web API

Not Applicable

Token cache serialization

In-memory caches

Description

In versions 2.0.2-preview and following, the AccessDenied page is not returned when requested. Instead, the app returns a 404 response.

Reproduction steps

1. Clone the samples repo and open the project 1-WebApp-OIDC/1-1-MyOrg.
2. Update versions of Microsoft.Identity.Web and Microsoft.Identity.Web.UI to 2.5.0 (first version which displays the bug is 2.0.2-preview)
3. Configure appsettings.json with the required values

The following steps are just the easiest way to reproduce the error; This bug does not depend on the exact method of producing an AccessDenied redirect.

4. Add an authorization policy which requires a role that your user doesn't have:
   Startup.cs

   --- a/1-WebApp-OIDC/1-1-MyOrg/Startup.cs
   +++ b/1-WebApp-OIDC/1-1-MyOrg/Startup.cs
   @@ -37,6 +37,10 @@ namespace WebApp_OpenIDConnect_DotNet
                services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(options => Configuration.Bind("AzureAd", options));
   
   +            services.AddAuthorization(
   +                policies => { policies.AddPolicy("p-Test", p => p.RequireClaim("roles", "TestRole")); }
   +            );
   +
                services.AddControllersWithViews(options =>
                {
                    var policy = new AuthorizationPolicyBuilder()

5. Add authorization using that policy to the HomeController:

   --- a/1-WebApp-OIDC/1-1-MyOrg/Controllers/HomeController.cs
   +++ b/1-WebApp-OIDC/1-1-MyOrg/Controllers/HomeController.cs
   @@ -6,7 +6,7 @@ using WebApp_OpenIDConnect_DotNet.Models;
   
    namespace WebApp_OpenIDConnect_DotNet.Controllers
    {
   -    [Authorize]
   +    [Authorize(Policy = "p-Test")]
        public class HomeController : Controller
        {
            private readonly ILogger<HomeController> _logger;

6. Start the app and open in your browser

Error message

You will be redirected to https://localhost:44321/MicrosoftIdentity/Account/AccessDenied?ReturnUrl=%2F but the page will not be found.

Id Web logs

info: Microsoft.Hosting.Lifetime[14]
      Now listening on: https://localhost:44321
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://localhost:3110
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /Users/ejsink/src/active-directory-aspnetcore-webapp-openidconnect-v2/1-WebApp-OIDC/1-1-MyOrg
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:44321/ - -
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed. These requirements were not met:
      ClaimsAuthorizationRequirement:Claim.Type=roles and Claim.Value is one of the following values: (TestRole)
info: Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler[13]
      AuthenticationScheme: Cookies was forbidden.
info: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[13]
      AuthenticationScheme: OpenIdConnect was forbidden.
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished HTTP/1.1 GET https://localhost:44321/ - - - 302 0 - 76.8571ms
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:44321/MicrosoftIdentity/Account/AccessDenied?ReturnUrl=%2F - -
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished HTTP/1.1 GET https://localhost:44321/MicrosoftIdentity/Account/AccessDenied?ReturnUrl=%2F - - - 404 0 - 2.0688ms

Relevant code snippets

See reproduction steps.

Regression

2.0.0-preview

Expected behavior

The AccessDenied page should be returned properly.

[creativebrother]

It seems we have the issue too. 404 for /MicrosoftIdentity/Account/AccessDenied.

[creativebrother]

It seems this time the razor page routing is not working even though the page is there in the right path. In the host app razor page works no problem, just those pages provided by this lib in the UI project.

[jmprieur]

@ElijahSink @creativebrother

I can repro on the sample.

I didn't have the issue with the Microsoft.Identity.Web test apps. I got the following:

The code I used is:

           services.AddAuthorization(
                policies => { policies.AddPolicy("p-Test", p => p.RequireClaim("roles", "TestRole")); }
                        );

            services.AddRazorPages().AddMvcOptions(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            }).AddMicrosoftIdentityUI();

     // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
          // more here ..

            app.UseAuthentication();
            app.UseAuthorization();

            // more here...

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapRazorPages();
+                endpoints.MapControllers();
            });
        }

[creativebrother]

I used the code as the following: and I get 404:

            services.Configure<CookiePolicyOptions>(options =>
            {
                // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
                // Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1
                options.HandleSameSiteCookieCompatibility();
            });

            // Sign-in users with the Microsoft identity platform
            services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(options => Configuration.Bind("AzureAd", options));
            services.AddAuthorization(policies =>
            {
                policies.AddPolicy("p-Test", p => p.RequireClaim("roles", "TestRole"));
            });

            services.AddControllersWithViews(options =>
            {
            }).AddMicrosoftIdentityUI();

            services.AddRazorPages().AddMvcOptions(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            }).AddMicrosoftIdentityUI();`

`            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseCookiePolicy();

            app.UseRouting();

            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=Home}/{action=Index}/{id?}");

                endpoints.MapRazorPages();
            });

[creativebrother]

[creativebrother]

I tried you code snip and got:

[creativebrother]

If I downgrade the Microsoft.Identity.Web and Microsoft.Identity.Web.UI to 1.26.0, everything seems working. I was using the test project webapp-openidconnect-dotnet with solution 1-1-MyOrg by Cloning the samples repo

[creativebrother]

[creativebrother]

If I use 2.5.0 Microsoft.Identity.Web and 1.26.0 for Mircosoft.Identity.Web.UI, it seems also working. So looks like the Microsoft.Identity.Web.UI 2.5.0 is causing the issue.

[jmprieur]

Thanks for the repro steps, @creativebrother