I have identityserver4 v2.4 setup to user ASP.Net Identity and Entity Framework as an operational store. When I call tokenClient.RequestRefreshTokenAsync(oldRefreshToken); as follows, I always get an invalid_grant error in the tokenResult
TokenClient tokenClient = new TokenClient(tokenEndpoint, clientId, clientSecret);
string oldRefreshToken = await context.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
TokenResponse tokenResult = await tokenClient.RequestRefreshTokenAsync(oldRefreshToken);
The IDS4 logs show an ArgumentException in the logs (Note that there are a lot of similar issues with the Parameter name being value instead of Parameter name: type as is in my case. I do not think they are related since the fixes recommended for those did not work for me). The exceptions seems to get raised in the IDS4 ClaimsConverter. I did check my MySQL database for any null values fields in the asp.net user and claims tables and confirmed there are none:
[14:17:12 Debug] IdentityServer4.Validation.TokenRequestValidator
Start token request validation
[14:17:12 Debug] IdentityServer4.Validation.TokenRequestValidator
Start validation of refresh token request
[14:17:12 Debug] IdentityServer4.EntityFramework.Stores.PersistedGrantStore
pY3Q91B7RFXV2ilzuJtI+ggqkOg9xiRx4HcGZMfJf+0= found in database: True
[14:17:12 Error] IdentityServer4.Stores.DefaultRefreshTokenStore
Failed to deserialize JSON from grant store.
System.ArgumentNullException: Value cannot be null.
Parameter name: type
at System.Security.Claims.Claim..ctor(String type, String value, String valueType, String issuer, String originalIssuer, ClaimsIdentity subject, String propertyKey, String propertyValue)
at System.Security.Claims.Claim..ctor(String type, String value, String valueType)
at IdentityServer4.Stores.Serialization.ClaimConverter.ReadJson(JsonReader reader, Type objectType, Object existingValue, JsonSerializer serializer) in C:\local\identity\server4\IdentityServer4\src\Storage\src\Stores\Serialization\ClaimConverter.cs:line 24
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.DeserializeConvertable(JsonConverter converter, JsonReader reader, Type objectType, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateList(IList list, JsonReader reader, JsonArrayContract contract, JsonProperty containerProperty, String id)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateList(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, Object existingValue, String id)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.SetPropertyValue(JsonProperty property, JsonConverter propertyConverter, JsonContainerContract containerContract, JsonProperty containerProperty, JsonReader reader, Object target)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.SetPropertyValue(JsonProperty property, JsonConverter propertyConverter, JsonContainerContract containerContract, JsonProperty containerProperty, JsonReader reader, Object target)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
at IdentityServer4.Stores.DefaultGrantStore`1.GetItemAsync(String key) in C:\local\identity\server4\IdentityServer4\src\IdentityServer4\src\Stores\Default\DefaultGrantStore.cs:line 92
[14:17:12 Warning] IdentityServer4.Validation.TokenValidator
Invalid refresh token
[14:17:12 Warning] IdentityServer4.Validation.TokenRequestValidator
Refresh token validation failed. aborting.
My Client config in IDS4 is as follows
new Client
{
ClientId = "AspNetClient",
ClientName = "ASP.Net Client",
RedirectUris = { "http://localhost:5003/signin-oidc" },
PostLogoutRedirectUris = { "http://localhost:5003/signout-callback-oidc" },
AllowedGrantTypes = GrantTypes.Hybrid,
RequireClientSecret = true,
ClientSecrets =
{
new Secret("AspNetClientSecret".Sha256())
},
RequireConsent = false,
AlwaysSendClientClaims = true,
AlwaysIncludeUserClaimsInIdToken = true,
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
IdentityServerConstants.StandardScopes.Email,
IdentityServerConstants.StandardScopes.OfflineAccess,
"AccessTokenAuthorizedApi"
},
AllowOfflineAccess = true,
AccessTokenLifetime = (int) TimeSpan.FromSeconds(10).TotalSeconds,
RefreshTokenUsage = TokenUsage.ReUse,
RefreshTokenExpiration = TokenExpiration.Absolute,
AbsoluteRefreshTokenLifetime = (int) TimeSpan.FromDays(30).TotalSeconds,
UpdateAccessTokenClaimsOnRefresh = true
}
What am I doing wrong?
UPDATE 2019-05-15:
So I did a little more digging and retrieved the actual record in the PersistedGrants table using the key found in the log which is pY3Q91B7RFXV2ilzuJtI+ggqkOg9xiRx4HcGZMfJf+0=. I can see 4 empty claims in the JSON text from the Data field which must be causing the issue. But why does IDS4 add empty claims like this?
{
"CreationTime":"2019-05-15T08:47:03Z",
"Lifetime":2592000,
"AccessToken":{
"Audiences":[
"http://localhost:5000/resources",
"AccessTokenAuthorizedApi"
],
"Issuer":"http://localhost:5000",
"CreationTime":"2019-05-15T08:47:03Z",
"Lifetime":10,
"Type":"access_token",
"ClientId":"AspNetClient",
"AccessTokenType":0,
"Claims":[
{
"Type":"client_id",
"Value":"AspNetClient",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"scope",
"Value":"openid",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"scope",
"Value":"profile",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"scope",
"Value":"email",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"scope",
"Value":"AccessTokenAuthorizedApi",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"scope",
"Value":"offline_access",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"sub",
"Value":"0170490c-24c9-4be4-ae2a-5d4b1c55346e",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"auth_time",
"Value":"1557910023",
"ValueType":"http://www.w3.org/2001/XMLSchema#integer"
},
{
"Type":"idp",
"Value":"local",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"amr",
"Value":"pwd",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"AspNet.Identity.SecurityStamp",
"Value":"IF6RRMICBOOITA56FEJLPTFBXCIUKW3Z",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"role",
"Value":"Driver",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"role",
"Value":"Helper",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"preferred_username",
"Value":"hybrid1",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
"Type":"name",
"Value":"hybrid1",
"ValueType":"http://www.w3.org/2001/XMLSchema#string"
},
{
},
{
},
{
},
{
}
],
"Version":4
},
"Version":4
}
Ok so it looks like IDS4 is not serializing derived claims objects as I expected it to. I was using a custom TenantClaim class which inherits Claim and added 4 such objects in my custom IProfileService implementation in the IdentityServer project like so:
public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
// Other Code
var tenantRoleClaim = new TenantRoleClaim(tenantRole.TenantId, tenantRole.Role);
claims.Add(tenantRoleClaim);
context.IssuedClaims = claims;
}
Once I changed it to use plain old Claim type objects, the code worked.
public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
// Other Code
var tenantRoleClaim = new TenantRoleClaim(tenantRole.TenantId, tenantRole.Role);
claims.Add(new Claim(tenantRoleClaim.Type, tenantRoleClaim.Value));
context.IssuedClaims = claims;
}