Identityserver4: IOException: IDX10804: Unable to retrieve document from

Created on 21 Jan 2017  ·  18Comments  ·  Source: IdentityServer/IdentityServer4

Issue / Steps to reproduce the problem

I am using ASP.NET 5, In my solution I have Web API, Identity Server and Angular 2 project and I am authenticating Angular 2 client by using Identity Server, Angular 2 client consumes web api by passing token in http request and web api authenticate token and gives response.

The login process is fine and I get back the correct bearer. The problem starts when I am trying to consume an end point, with [Autorization] Attribute for example http://identity.wilbool.com/api/APIFields from a differenr domain, for example http://www.wilbool.gr. I have enabled CORS in mvc.

The response I Get is IOException: IDX10804: Unable to retrieve document from: http://identity.wilbool.com/.well-known/openid-configuration

Could you please advise me why is this happening?

In ConfigureServices Function:

var builder = services.AddIdentityServer(options =>
{
options.Events = new EventsOptions()
{
RaiseErrorEvents = true,
RaiseFailureEvents = true,
RaiseInformationEvents = true,
RaiseSuccessEvents = true
};

        });
builder.AddTemporarySigningCredential();
builder.AddInMemoryApiResources(GetApiResources());
builder.AddInMemoryClients(Clients.Get());

In Configure Function:

app.UseIdentityServer();

        app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions()
        {                
            Authority = "http://identity.wilbool.com",
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            RequireHttpsMetadata = false,
            ApiName = "wilbool"                
        });

        app.UseMvc();

System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: A security error occurred
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.WinHttpHandler.<StartRequest>d__103.MoveNext()
   --- End of inner exception stack trace ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.HttpClient.<FinishSendAsync>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.<GetDocumentAsync>d__8.MoveNext()
question
Source
picture saridakis

Most helpful comment

Hi, I had this issue for over a week and this is how I resolved it:

The problem I had was the fact that I was using the "IIS Express Development Certificate" and for some odd reason it wasn't a trusted certificate on my dev machine hence it was only broken on this particular environment. To fix it, export the IIS Express Development Certificate and import it back in to the "Trusted Root Certification Authorities"->"Certificate".

picture Farshidgolkarihagh on 15 Aug 2017
👍2 ❤1

All 18 comments

A security error occurred

Sounds like an environmental issue. I can view the metadata from my browser: http://identity.wilbool.com/.well-known/openid-configuration

brockallen picture brockallen on 21 Jan 2017

I have the same Issue, when the identityserver and client running at localhost , all is Ok. but if i publish the identityserver to the server. and run client(mvc) at local, the issue raise.

HttpRequestException: Response status code does not indicate success: 500 (Internal Server Error).
System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()

IOException: IDX10804: Unable to retrieve document from: 'http://192.168.1.17:5000/.well-known/openid-configuration/jwks'.
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever+d__8.MoveNext()

InvalidOperationException: IDX10803: Unable to obtain configuration from: 'http://192.168.1.17:5000/.well-known/openid-configuration'.
Microsoft.IdentityModel.Protocols.ConfigurationManager+d__24.MoveNext()

Cuiqs76 picture Cuiqs76 on 22 Jan 2017

I replace AddTemporarySigningCredential to AddSigningCredential(cert). the problem is sovled.

Cuiqs76 picture Cuiqs76 on 22 Jan 2017

I have the same problem, but while developing on localhost. I do not get a security error occurred though. I can also access the resource in the browser without any issues. Only when I try to authenticate a request with a token I get the internal server error.

Christian24 picture Christian24 on 22 Jan 2017

HttpRequestException: Response status code does not indicate success: 500 (Internal Server Error).
System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()

If your server issues a 500, then you should enable logging to debug the problem.

brockallen picture brockallen on 22 Jan 2017

Well all I have been able to figure out so far is that the request to http://localhost:3643/.well-known/openid-configuration fails because it is not found. Is there specific logging for IdentityServer? Because there is no detail at http://docs.identityserver.io/en/release/topics/logging.html

Christian24 picture Christian24 on 22 Jan 2017

Enable ASP.NET Core logging and see what it says.

brockallen picture brockallen on 22 Jan 2017

@Cuiqs76 could you tell me please how did you load the certification? I did use AddSigningCredential but still get the some error ...

WinHttpException: A security error occurred
MoveNext

HttpRequestException: An error occurred while sending the request.
MoveNext

IOException: IDX10804: Unable to retrieve document from: 'http://identity.wilbool.com/.well-known/openid-configuration'.
MoveNext

InvalidOperationException: IDX10803: Unable to obtain configuration from: 'http://identity.wilbool.com/.well-known/openid-configuration'.

and here is the code:

X509Certificate2 Certificate = null;
var certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
certStore.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
var certCollection = certStore.Certificates.Find(X509FindType.FindBySubjectName, "cert.wilbool", false);
Certificate = certCollection[0];
builder.AddSigningCredential(Certificate);

In folder C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA the Everyone has Full Permisions. Could be a permision issue?

saridakis picture saridakis on 22 Jan 2017

That is all I get in my log:
`Microsoft.AspNetCore.Hosting.Internal.WebHost: Information: Request starting HTTP/1.1 POST http://localhost:3643/api/categories/1 text/plain;charset=UTF-8 23
Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware: Error: Exception occurred while processing message.

System.InvalidOperationException: IDX10803: Unable to obtain configuration from: 'http://localhost:3643/.well-known/openid-configuration'.
bei Microsoft.IdentityModel.Protocols.ConfigurationManager`1.d__24.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
bei System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
bei Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.d__1.MoveNext()
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware: Error: An unhandled exception has occurred while executing the request

System.InvalidOperationException: IDX10803: Unable to obtain configuration from: 'http://localhost:3643/.well-known/openid-configuration'.
bei Microsoft.IdentityModel.Protocols.ConfigurationManager1.<GetConfigurationAsync>d__24.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task) bei Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() bei Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Authentication.AuthenticationHandler1.d__52.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.<Invoke>d__18.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei IdentityServer4.AccessTokenValidation.IdentityServerAuthenticationMiddleware.<Invoke>d__7.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei IdentityServer4.Hosting.IdentityServerMiddleware.<Invoke>d__3.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei IdentityServer4.Hosting.FederatedSignOutMiddleware.<Invoke>d__6.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei IdentityServer4.Hosting.AuthenticationMiddleware.<Invoke>d__2.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.<Invoke>d__7.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei IdentityServer4.Hosting.BaseUrlMiddleware.<Invoke>d__2.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.d__18.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.<Invoke>d__18.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.d__18.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.<Invoke>d__18.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.d__18.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.<Invoke>d__18.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.d__18.MoveNext()
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
bei Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.<Invoke>d__18.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.MigrationsEndPointMiddleware.<Invoke>d__5.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.<Invoke>d__6.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() bei Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.<Invoke>d__6.MoveNext() --- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde --- bei System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) bei Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext() Microsoft.AspNetCore.Hosting.Internal.WebHost: Information: Request finished in 33.9531ms 500 text/html; charset=utf-8

Christian24 picture Christian24 on 22 Jan 2017

@saridakis if you publish the app to server , remember include the idsvr3test.pfx for testing.

` public void ConfigureServices(IServiceCollection services)
{
var connectionString = Configuration.GetConnectionString("DefaultConnection");
var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
var cert = new X509Certificate2(Path.Combine(_environment.ContentRootPath, "idsvr3test.pfx"), "idsrv3test");

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(connectionString, b => b.UseRowNumberForPaging()));          

        services.AddIdentity<ApplicationUser, IdentityRole>()
           .AddEntityFrameworkStores<ApplicationDbContext>()
           .AddDefaultTokenProviders()
           .AddIdentityServerUserClaimsPrincipalFactory();

        services.AddIdentityServer()
           .AddSigningCredential(cert)
           .AddSecretParser<ClientAssertionSecretParser>()
           .AddSecretValidator<PrivateKeyJwtSecretValidator>()
           .AddAspNetIdentity<ApplicationUser>()         
           .AddConfigurationStore(builder =>
               builder.UseSqlServer(connectionString,
                   options => options.MigrationsAssembly(migrationsAssembly)))
           .AddOperationalStore(builder =>
               builder.UseSqlServer(connectionString,
                   options => options.MigrationsAssembly(migrationsAssembly)));

        services.AddMvc();
    }`
Cuiqs76 picture Cuiqs76 on 24 Jan 2017

Any update on the issue? closing for now - feel free to re-open if it needs further discussion.

leastprivilege picture leastprivilege on 5 Feb 2017

My api is not exposing openid metdata. if i am trying to send a request through browser for http://localhost:58973/.well-known/openid-configuration returning 404 error.

goelmukesh picture goelmukesh on 19 Jul 2017

Hi, I had this issue for over a week and this is how I resolved it:

The problem I had was the fact that I was using the "IIS Express Development Certificate" and for some odd reason it wasn't a trusted certificate on my dev machine hence it was only broken on this particular environment. To fix it, export the IIS Express Development Certificate and import it back in to the "Trusted Root Certification Authorities"->"Certificate".

Farshidgolkarihagh picture Farshidgolkarihagh on 15 Aug 2017
👍2 ❤1

@Farshidgolkarihagh thing helped me. I followed this:
https://blogs.msdn.microsoft.com/robert_mcmurray/2013/11/15/how-to-trust-the-iis-express-self-signed-certificate/

I don't understand why this happened. Can someone explains please I am very keen to understand why this stops working randomly? Cert didn't remove itself obvisouly, so it's something else.

nukec picture nukec on 8 Sep 2017

@Cuiqs76 -- were you experiencing the problem every request when you were using the temporary signing cert? If so, adding the fixed signing credential resolved it immediately?

Were you able to determine any level of root cause? The signing cert does not seem to be related to the cert for the configuration endpoint in question here. Thanks!

fshin123 picture fshin123 on 20 Jun 2018

I had this problem as well when I was setting up federation from localhost to the Identity Server 4 demo environment.

Additional details:

  • I am using ASP.NET Core 2.1
  • I am using ASP.NET Core Identity

This was related to the fact that at the enterprise were I am working, all outbound traffic needs to be authenticated and pass through a proxy. I found a way to circumvent this at the moment (by intercepting the calls using Fiddler which allows for an authenticated proxy).

However, I was wondering if it is possible to either:

  • Replace the HttpClient used for retrieving the configuration.
  • Configure the HttpClient to use a proxy.
  • Add HttpHandlers for the HttpClient to use?

So I went looking into the source code and found out that the HttpClient used for making these requests is set via the Backchannel. (Or you can set the HttpHandler via the BackchannelHttpHandler)

So, in short when adding OpenIdConnect you can use the following code to use your own client:
services.AddAuthentication().AddOpenIdConnect(authenticationScheme, name, options => options.Backchannel = );

Hope this helps anyone.

Meertman picture Meertman on 30 Aug 2018

I just recieved this error, when running on our production server, but not on localhost.

It turns out that my production server didn't have a connection to the outside internet, and could not access the information needed for the authentication from Microsoft's servers.

Pretty simple issue, but it took me a while to figure it out.

MaxxDelusional picture MaxxDelusional on 2 Jan 2019

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

lock[bot] picture lock[bot] on 12 Jan 2020
Was this page helpful?
0 / 5 - 0 ratings

Related issues

klioqc picture klioqc  ·  3Comments
agilenut picture agilenut  ·  3Comments
osudude picture osudude  ·  3Comments
mackie1001 picture mackie1001  ·  3Comments
createroftheearth picture createroftheearth  ·  3Comments