We are trying to run the HelloWorldSeparateAuth sample:
We appreciate that this sample has not been maintained for several years, but we are not currently aware of a more recent ASP.NET Core example.
We have updated the sample to run on .NET 10.
As the Sandbox environment has not been available to us, we were advised to integrate directly with the CIS2 INT environment.
We have successfully onboarded to Connection Manager and generated an OIDC client configuration. We are using the client generated by Connection Manager and not the Developer Portal application registration as our OIDC client.
We also discovered that the sample required modification to use:
ResponseMode = OpenIdConnectResponseMode.Query;
as CIS2 INT does not appear to support form_post.
After making this change we can successfully:
- redirect to the CIS2 Authorize endpoint
- authenticate using our AAL3 Windows Hello credential
- receive a valid Authorization Code
- return successfully to our /signin-oidc callback
The failure now occurs during the Authorization Code redemption.
The ASP.NET Core middleware reports:
OpenIdConnectProtocolException:
Message contains error: ‘invalid_client’,
error_description: ‘Invalid authentication method for accessing this endpoint.’
From discussions with the onboarding team we understand that the request reaching the CIS2 token endpoint is returning HTTP 400.
From our investigation we believe the issue may be that the sample predates the current requirement for Private Key JWT client authentication.
Our Connection Manager client is configured for:
- Client Authentication Method: Private Key JWT
The original sample does not appear to attach a client assertion during the token exchange.
We therefore attempted to generate a JWT client assertion and populate:
c.TokenEndpointRequest.ClientAssertionType =
"urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
c.TokenEndpointRequest.ClientAssertion = clientAssertion;
This changes the behaviour, but we now receive the following error.
invalid_client
Client ID in request does not match authenticated client
This response suggests the token endpoint is successfully parsing the JWT but that the authenticated client does not match the client_id supplied in the request.
Could you please confirm the expected construction of the Private Key JWT for supplier clients in the INT environment, specifically:
- Which value should be used for the JWT iss claim? We are using the application id.
- Which value should be used for the JWT sub claim? We are using the application id.
- What should the JWT aud claim be? (Issuer URL, Token Endpoint URL, or another value?)
- Is there an updated ASP.NET Core sample demonstrating the current Connection Manager / Private Key JWT flow?
At this point the browser-based authentication flow is working correctly and the remaining issue appears to be limited to authenticating the client to the CIS2 token endpoint.