Open Closed

AzureOpenId - Authorisation failed! Give policy not granted #9081

User avatar
0
joey73 created

  • Exception message and full stack trace:
    Category: Volo.Abp.AspNetCore.Mvc.ExceptionHandling.AbpExceptionFilter EventId: 0 SpanId: 605708dfb57b10ff TraceId: b05b96c021d044380123f354b3da735f ParentId: 0000000000000000 RequestId: 800218e9-0000-e900-b63f-84710c7967bb RequestPath: /Admin/Home ActionId: 4bd4df1e-c853-4862-bf28-3efacc744a05 ActionName: /Home/Index ---------- RemoteServiceErrorInfo ---------- { "code": "Volo.Authorization:010001", "message": "Authorisation failed! Given policy has not granted.", "details": null, "data": {}, "validationErrors": null }

*Category: Volo.Abp.AspNetCore.Mvc.ExceptionHandling.AbpExceptionFilter EventId: 0 SpanId: 605708dfb57b10ff TraceId: b05b96c021d044380123f354b3da735f ParentId: 0000000000000000 RequestId: 800218e9-0000-e900-b63f-84710c7967bb RequestPath: /Admin/Home ActionId: 4bd4df1e-c853-4862-bf28-3efacc744a05 ActionName: /Home/Index Exception of type 'Volo.Abp.Authorization.AbpAuthorizationException' was thrown. Exception: Volo.Abp.Authorization.AbpAuthorizationException: Exception of type 'Volo.Abp.Authorization.AbpAuthorizationException' was thrown. at Microsoft.AspNetCore.Authorization.AbpAuthorizationServiceExtensions.CheckAsync(IAuthorizationService authorizationService, AuthorizationPolicy policy) at Volo.Abp.Authorization.MethodInvocationAuthorizationService.CheckAsync(MethodInvocationAuthorizationContext context) at Volo.Abp.Authorization.AuthorizationInterceptor.AuthorizeAsync(IAbpMethodInvocation invocation) at Volo.Abp.Authorization.AuthorizationInterceptor.InterceptAsync(IAbpMethodInvocation invocation) at Volo.Abp.Castle.DynamicProxy.CastleAsyncAbpInterceptorAdapter1.InterceptAsync[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo, Func3 proceed) at Castle.DynamicProxy.AsyncInterceptorBase.ProceedAsynchronous[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo) at Volo.Abp.Castle.DynamicProxy.CastleAbpMethodInvocationAdapterWithReturnValue1.ProceedAsync() at Volo.Abp.GlobalFeatures.GlobalFeatureInterceptor.InterceptAsync(IAbpMethodInvocation invocation) at Volo.Abp.Castle.DynamicProxy.CastleAsyncAbpInterceptorAdapter1.InterceptAsync[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo, Func3 proceed) at Castle.DynamicProxy.AsyncInterceptorBase.ProceedAsynchronous[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo) at Volo.Abp.Castle.DynamicProxy.CastleAbpMethodInvocationAdapterWithReturnValue1.ProceedAsync() at Volo.Abp.Auditing.AuditingInterceptor.ProceedByLoggingAsync(IAbpMethodInvocation invocation, AbpAuditingOptions options, IAuditingHelper auditingHelper, IAuditLogScope auditLogScope) at Volo.Abp.Auditing.AuditingInterceptor.InterceptAsync(IAbpMethodInvocation invocation) at Volo.Abp.Castle.DynamicProxy.CastleAsyncAbpInterceptorAdapter1.InterceptAsync[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo, Func3 proceed) at Castle.DynamicProxy.AsyncInterceptorBase.ProceedAsynchronous[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo) at Volo.Abp.Castle.DynamicProxy.CastleAbpMethodInvocationAdapterWithReturnValue1.ProceedAsync() at Volo.Abp.Validation.ValidationInterceptor.InterceptAsync(IAbpMethodInvocation invocation) at Volo.Abp.Castle.DynamicProxy.CastleAsyncAbpInterceptorAdapter1.InterceptAsync[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo, Func3 proceed) at Castle.DynamicProxy.AsyncInterceptorBase.ProceedAsynchronous[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo) at Volo.Abp.Castle.DynamicProxy.CastleAbpMethodInvocationAdapterWithReturnValue1.ProceedAsync() at Volo.Abp.Uow.UnitOfWorkInterceptor.InterceptAsync(IAbpMethodInvocation invocation) at Volo.Abp.Castle.DynamicProxy.CastleAsyncAbpInterceptorAdapter1.InterceptAsync[TResult](IInvocation invocation, IInvocationProceedInfo proceedInfo, Func3 proceed) at Steer73.projIT.Web.Pages.Vacancies.IndexModelBase.OnGetAsync() in D:\a\1\s\src\Steer73.projIT.Web\Pages\Vacancies\Index.cshtml.cs:line 103 at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.ExecutorFactory.NonGenericTaskHandlerMethod.Execute(Object receiver, Object[] arguments) at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker.InvokeHandlerMethodAsync() at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker.InvokeNextPageFilterAsync() at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker.Rethrow(PageHandlerExecutedContext context) at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker.InvokeInnerFilterAsync() at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|26_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)

Category: Volo.Abp.AspNetCore.Mvc.ExceptionHandling.AbpExceptionFilter EventId: 0 SpanId: 605708dfb57b10ff TraceId: b05b96c021d044380123f354b3da735f ParentId: 0000000000000000 RequestId: 800218e9-0000-e900-b63f-84710c7967bb RequestPath: /Admin/Home ActionId: 4bd4df1e-c853-4862-bf28-3efacc744a05 ActionName: /Home/Index Code:Volo.Authorization:010001

------------------------------------------------End Exception--------------------------------------------------

We have created a project which uses AzureOpenId(OpenIdConnect) to allow users to login through Azure entra. Currently hosted in our own environment everything works correctly. We are building this for someone and have setup the same infrastructure within their own portal. Everything is working as a normal user when you login through u/n p/w. However logging in through AzureOpenId is working, but it appears we are getting the above issues. We also receive this on occassion

An error was encountered while handling the remote login. Message contains error: 'invalid_grant', error_description: 'AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access ', error_uri: 'https://login.microsoftonline.com/error?code=50076'

It's like AzureOpenId is not refreshing properly. I'm trying to prove whether this is a setup issue on the AppRegistration which I can't see. Or something that ABP/OpenId is doing.

Can you help at all and is there any potential further logging I can do to try and get down to the bottom of this.

Go to accepted answer
1 Answer(s)
  • User Avatar
    0
    enisn created
    Support Team .NET Developer

    The error message indicates that the requested authorization policy was not granted, stemming from either a configuration issue or missing permissions. Based on the details provided, here are a few steps to troubleshoot the issue:

    1. Policy Configuration:

      • Verify that the required authorization policy is correctly defined in your project. Policies in ABP Framework can be set in the Startup.cs file using the ConfigureServices method. Ensure that the specific policy mentioned is correctly implemented and mapped to roles or claims.

    2. Azure App Registration Settings:

      • Double-check the settings for your Azure App Registration. Specifically:

        • Check API permissions to ensure the necessary scope is granted.

        • Validate Redirect URIs to match the URLs used in your application.

        • Ensure that Multi-Factor Authentication (MFA) settings align with the organization’s configuration. The error AADSTS50076 is often related to MFA requirements or configuration changes.

    3. Claims Mapping:

      • Confirm that claims are being correctly mapped during authentication and that the claim used in the authorization policy is present. Check logs to ensure claims are being read correctly after login.

    4. Logging and Debugging:

      • Enable detailed logging for your application to capture errors related to OpenIdConnect authentication.

      • Use tools like Fiddler or browser developer tools to analyze the authentication flow and see where issues might arise.

    5. Check ABP Framework Configuration:

      • Verify the configuration settings for OpenIdConnect in your application, especially the identity server integration within ABP. Ensure your settings in appsettings.json align with Azure portal configuration.

Assignee
No one
Question details
Labels
None yet
Boost Your Development
ABP Live Training
Packages
See Trainings
Mastering ABP Framework Book
Do you need assistance from an ABP expert?
Schedule a Meeting
Mastering ABP Framework Book
The Official Guide
Mastering
ABP Framework
Learn More
Mastering ABP Framework Book
Made with ❤️ on ABP v9.3.0-preview. Updated on April 10, 2025, 12:38