Blazor WASM hosted on IIS 10 log in exception for some users.

[Kazbek]

Describe the bug

I`m using blazor webassembly with authorization on IdentityServer (as from the box). Now app published on IIS 10. And 4 user of 200+ registered when login has this error:

Some of them use Google Chrome, some Mozilla Firefox

To Reproduce

I can't reproduce that. For them reauthorize doesn`t help (also cache clearing) but they can log in from other devices.

Exceptions

When I login myself (withoit error). Browser console log: All Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1] have index '[1]'.

info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[100]
      Start processing HTTP request POST .../Course.Course/GetCourseIndex
blazor.webassembly.js:1 info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[100]
      Start processing HTTP request POST .../UserInfo.UserInfo/GetCurrentUserShortName
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[100]
      Sending HTTP request POST .../Course.Course/GetCourseIndex
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[100]
      Sending HTTP request POST .../UserInfo.UserInfo/GetCurrentUserShortName
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[101]
      Received HTTP response after 243.53ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[101]
      End processing HTTP request after 489.965ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[101]
      Received HTTP response after 379.355ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[101]
      End processing HTTP request after 784.4049ms - OK
blazor.webassembly.js:1 info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.

When I log in as user who has error (I don`t have error but anyway) some of Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2] (have number 2 and failed).

info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[100]
      Start processing HTTP request POST .../Course.Course/GetCourseIndex
blazor.webassembly.js:1 info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed.
blazor.webassembly.js:1 info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[100]
      Start processing HTTP request POST .../UserInfo.UserInfo/GetCurrentUserShortName
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[100]
      Sending HTTP request POST .../Course.Course/GetCourseIndex
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[100]
      Sending HTTP request POST .../UserInfo.UserInfo/GetCurrentUserShortName
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[101]
      Received HTTP response after 203.9549ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[101]
      End processing HTTP request after 511.6849ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.ClientHandler[101]
      Received HTTP response after 233.73ms - OK
blazor.webassembly.js:1 info: System.Net.Http.HttpClient.AuthCenter.gRPC.LogicalHandler[101]
      End processing HTTP request after 437.115ms - OK
blazor.webassembly.js:1 info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed.

But on screenshot from the user I see only failed with number 2 and none of DefaultAuthorizationService[1] (I apologize for the quality of the screenshot, it was sent by the user):

A bit of code

Program.cs

var builder = WebAssemblyHostBuilder.CreateDefault(args);
builder.RootComponents.Add<App>("app");

builder.Services.AddHttpClient("AuthCenter.ServerAPI", client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();

builder.Services.AddHttpClient("AuthCenter.gRPC", client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .ConfigurePrimaryHttpMessageHandler(() => new GrpcWebHandler(GrpcWebMode.GrpcWeb, new HttpClientHandler()))
    .AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();

builder.Services.AddTransient(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("AuthCenter.ServerAPI"));

builder.Services.AddOptions();
builder.Services.AddAuthorizationCore();
builder.Services.AddApiAuthorization(options =>
{
    options.UserOptions.RoleClaim = "role";
}).AddAccountClaimsPrincipalFactory<RolesClaimsPrincipalFactory>(); ;

builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();

builder.Services.AddScoped(services =>
{
    var httpClient = services.GetRequiredService<IHttpClientFactory>().CreateClient("AuthCenter.gRPC");
    var channel = GrpcChannel.ForAddress(httpClient.BaseAddress, new GrpcChannelOptions { HttpClient = httpClient });
    return new UserInfo.UserInfoClient(channel);
});

builder.Services.AddScoped(services =>
{
    var httpClient = services.GetRequiredService<IHttpClientFactory>().CreateClient("AuthCenter.gRPC");
    var channel = GrpcChannel.ForAddress(httpClient.BaseAddress, new GrpcChannelOptions { HttpClient = httpClient });
    return new Course.CourseClient(channel);
});

builder.Services.AddScoped(services =>
{
    var httpClient = services.GetRequiredService<IHttpClientFactory>().CreateClient("AuthCenter.gRPC");
    var channel = GrpcChannel.ForAddress(httpClient.BaseAddress, new GrpcChannelOptions { HttpClient = httpClient });
    return new StudyGroups.StudyGroupsClient(channel);
});

builder.Services.AddBlazoredModal();
builder.Services.AddBlazoredToast();
builder.Services.AddScoped<IToastService, ToastService>();

await builder.Build().RunAsync();

RolesClaimsPrincipalFactory.cs

public class RolesClaimsPrincipalFactory : AccountClaimsPrincipalFactory<RemoteUserAccount>
{
    public RolesClaimsPrincipalFactory(IAccessTokenProviderAccessor accessor) : base(accessor)
    {
    }

    public override async ValueTask<ClaimsPrincipal> CreateUserAsync(RemoteUserAccount account, RemoteAuthenticationUserOptions options)
    {
        var user = await base.CreateUserAsync(account, options);
        if (user.Identity.IsAuthenticated)
        {
            var identity = (ClaimsIdentity)user.Identity;
            var roleClaims = identity.FindAll(identity.RoleClaimType);
            if (roleClaims != null && roleClaims.Any())
            {
                foreach (var existingClaim in roleClaims)
                {
                    identity.RemoveClaim(existingClaim);
                }

                var rolesElem = account.AdditionalProperties[identity.RoleClaimType];
                if (rolesElem is JsonElement roles)
                {
                    if (roles.ValueKind == JsonValueKind.Array)
                    {
                        foreach (var role in roles.EnumerateArray())
                        {
                            identity.AddClaim(new Claim(options.RoleClaim, role.GetString()));
                        }
                    }
                    else
                    {
                        identity.AddClaim(new Claim(options.RoleClaim, roles.GetString()));
                    }
                }
            }
        }

        return user;
    }
}

Further technical details

dotnet --info
Џ ЄҐв SDK ¤«п .NET Core (®ва ¦ ойЁ© «оЎ®© global.json):
Version: 3.1.301
Commit: 7feb845744

‘।  ўлЇ®«­Ґ­Ёп:
OS Name: Windows
OS Version: 10.0.18363
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\3.1.301\

Host (useful for support):
Version: 3.1.5
Commit: 65cd789777

.NET Core SDKs installed:
2.1.202 [C:\Program Files\dotnet\sdk]
2.1.402 [C:\Program Files\dotnet\sdk]
2.1.403 [C:\Program Files\dotnet\sdk]
2.1.502 [C:\Program Files\dotnet\sdk]
2.1.505 [C:\Program Files\dotnet\sdk]
2.2.101 [C:\Program Files\dotnet\sdk]
3.1.101 [C:\Program Files\dotnet\sdk]
3.1.301 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.15 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.1 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 3.1.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

VisualStudio.16.Release/16.6.2+30204.135

ASP.NET and Web Tools 2019 16.6.948.25768
ASP.NET and Web Tools 2019

ASP.NET Core Razor Language Services 16.1.0.2020603+b3ac44798c16fff5b95dbcfe62dea84aa9a1bd72
Provides languages services for ASP.NET Core Razor.

I’m sorry if I did something wrong, for a week now we can’t find the cause of this problem.

[javiercn]

@Kazbek thanks for contacting us.

Are you saying that clearing the local/session storage doesn't fix the issue?

Are they able to login if they use InPrivate browsing?
Does this error happen right away or after they've had a tab open for some time?

The code you have looks right to me, but at the same time I'm not sure what is going wrong.

[Kazbek]

Are you saying that clearing the local/session storage doesn't fix the issue?
Are they able to login if they use InPrivate browsing?

Doesn`t fix. Neither login use InPrivate browsing.

Does this error happen right away or after they've had a tab open for some time?

This happen right after tab open and loaded. All pages of app have [Authorize] attribute.
Also app serving method have [Authorize] attribute. So they are successful log in on login page. (Scaffolded Identity pages)

[Authorize(AuthenticationSchemes = "Identity.Application")]
public class GatewayModel : PageModel
{
    public IActionResult OnGet([FromServices] IWebHostEnvironment webHost)
    {
        var file = webHost.WebRootFileProvider.GetFileInfo("index.html");
        return PhysicalFile(file.PhysicalPath, "text/html");
    }
}

And this is Authentication component which is a bit modified.

@page "/authentication/{action}"
@using Microsoft.AspNetCore.Components.WebAssembly.Authentication

@inject NavigationManager Navigation
@inject IJSRuntime JSRuntime
<div class="col-12">
    <div class="rounded-block">
        <div class="row">
            <div class="col-12">
                <RemoteAuthenticatorView Action="@Action" OnLogOutSucceeded="OnLogOutSucceededHandler" OnLogInSucceeded="OnLoginSucceededHandler">
                    <LoggingIn>
                        <h4>Авторизация...</h4>
                    </LoggingIn>
                    <CompletingLoggingIn>
                        <h4>Авторизация...</h4>
                    </CompletingLoggingIn>
                    <LogOut>
                        <h4>Завершение сессии...</h4>
                    </LogOut>
                    <CompletingLogOut>
                        <h4>Завершение сессии...</h4>
                    </CompletingLogOut>
                </RemoteAuthenticatorView>
                <div class="progress">
                    <div class="indeterminate"></div>
                </div>
            </div>
        </div>
    </div>
</div>
@code{
    [Parameter] public string Action { get; set; }

    private async Task OnLogOutSucceededHandler()
    {
        await JSRuntime.InvokeVoidAsync("GoToLink", System.IO.Path.Combine(Navigation.BaseUri, "Identity/Account/Login"));
    }

    private async Task OnLoginSucceededHandler()
    {
        Console.WriteLine("OnLoginSucceededHandler");
    }
}

[javiercn]

[Authorize(AuthenticationSchemes = "Identity.Application")]
public class GatewayModel : PageModel
{
    public IActionResult OnGet([FromServices] IWebHostEnvironment webHost)
    {
        var file = webHost.WebRootFileProvider.GetFileInfo("index.html");
        return PhysicalFile(file.PhysicalPath, "text/html");
    }
}

That looks wrong, why are you passing a scheme to [Authorize]?

Can you produce a minimal repro project on a public location so that we can take a look at it and try to help you?

[javiercn]

private async Task OnLogOutSucceededHandler()
{
    await JSRuntime.InvokeVoidAsync("GoToLink", System.IO.Path.Combine(Navigation.BaseUri, "Identity/Account/Login"));
}

This also doesn't seem right, you shouldn't send users to identity directly to be authenticated. authentication/login is responsible for starting the authentication flow.

[Kazbek]

[Authorize(AuthenticationSchemes = "Identity.Application")]
public class GatewayModel : PageModel
{
    public IActionResult OnGet([FromServices] IWebHostEnvironment webHost)
    {
        var file = webHost.WebRootFileProvider.GetFileInfo("index.html");
        return PhysicalFile(file.PhysicalPath, "text/html");
    }
}

That looks wrong, why are you passing a scheme to [Authorize]?

Can you produce a minimal repro project on a public location so that we can take a look at it and try to help you?

This just help me to avoid scenario when new user loads app, then redirected to login page and again load app. He just start with login page.

I can clear my project of business logic and publish it, will it be useful?

This also doesn't seem right, you shouldn't send users to identity directly to be authenticated. authentication/login is responsible for starting the authentication flow.

Here the problem is precisely in the redirection, or precisely in its address? I do not want the user to remain on the application page after exiting.

[javiercn]

This just help me to avoid scenario when new user loads app, then redirected to login page and again load app. He just start with login page.

It's not the same because it doesn't go through the authorize endpoint, so it does not perform an OAuth flow.

I can clear my project of business logic and publish it, will it be useful?

It would help us understand what's going on, at least make sure we are not missing anything that is not trivial.

Here the problem is precisely in the redirection, or precisely in its address? I do not want the user to remain on the application page after exiting.

The redirection is fine, but why send them to the login place, specially directly to the identity page? It shouldn't matter, but I'm worried that it can cause issues if the session is not established through IdentityServer.

[Kazbek]

I`m collected as more information as I can at this moment. Also prepared repo.

Additonal error information
One more user get this error. He use latest Google Chrome browser.
User agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

He send me few screenshots of console. Here only one error of loading jivo js (its chat which we use to get feedback, you can see it on screenshot, its blocked by uBlock). Second screenshot hava additional jivo errors (some time passed between screenshot was made). I`m hide some user personal information.

I`m also tried to install uBlock to check if it cause the error. But for me its all fine (I have same jivo js error). Correct site open screenshot:

It's not the same because it doesn't go through the authorize endpoint, so it does not perform an OAuth flow.

We also ask users try to go diretly to site address/index.html (to avoid going through action mentioned before) and login after redirection but they said it doesn`t help too.

Blazor version
Firstly app was created with version 3.2.0-rc1.20223.4 and later was updated when stable was released.

Repository

I cleaned the project. I tried to save all the settings. Changed the database from Postgres to ms sql file to simplify debugging. If something else is required, please let me know, I will try to do my best.
Repository: https://github.com/Kazbek/Test-BlazorAuthProblemDemo