model-view-controllerauthorizationidentityserver4

Identity Server 4: Why i receive unauthorized_client?


This is my initial setting for my mvc connecting with identity server.

 app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {                
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",
            Authority = "http://identity.azurewebsites.net",
            RedirectUri = "http://localhost:62419/signin-oidc",
            PostLogoutRedirectUri = "http://localhost:62419/signout-callback-oidc",
            ClientId = "mvc", 
            ResponseType = "id_token",
            Scope = "openid profile",
            UseTokenLifetime = false,
            RequireHttpsMetadata = false,
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = (context) =>
                {
                    var identity = context.AuthenticationTicket.Identity;
                    var name = identity.Claims.FirstOrDefault(c => c.Type == identity.NameClaimType)?.Value;

                    return Task.FromResult(0);
                }
            }
        });

I can get to the identity server. I received a message

Sorry, there was an error : unauthorized_client Invalid redirect_uri

I have added the redirectUri into the ClientRedirectUris table matched with the code shown above. Is there any other area i forgot to add or set.

Request url: http://identity.azurewebsites.net/home/error?errorId=CfDJ8BPcf2qEDmRMt0TtYfAIujdUrTeIfqktT2TIcVFNomo6u6QFAROi-gEI2wXHP8kbmmiSYIK1aRV1nL-h6tFY_KeZabkMhIzy-V_0vvo2-hUFfj6I66qJWSjPiRhSYmGZa_-kYlULMb8a1Bz6UQ9UV5L6VdLscQRhScCpnOYpM6Ku84KM_S-4eZXrAX13EaVhqjxhpNhD8jIU9kJkjAn1t6sLVGrfZSEM0tAOGkTXFvBzuoucYURIFhZPJPGjVuJuRegrS2vsLPALHJCv3MLrW9ImudDeCkgf9VhAHwrRLfP3TB_7i4OvEffZwhuDuCSoyQ


Solution

  • Late to the party but will add my two cents:

    Generally the unauthorized_client means that there was something wrong with the validation of your client.

    This can be any of the client settings:

    Client Id
    Client Secret (if used)
    PKCE (if used)
    Return Url
    Scopes (not matching)
    Grant Type (not allowed)
    

    This is not an exhaustive list, there might be other properties that will lead to the client being rejected.

    If you are getting this error, make sure your settings on the client end and the Identity Server end are matching, most likely there is some configuration misalignment.