Adding Azure AD as External Provider With Dynamic Options #9972

2 Answer(s)

• 

  0

  AI-Bot created 2 hours ago

  Support Team ABP Agent

  To add Azure AD as an external provider with dynamic options in ABP, you need to ensure that the dynamic options are properly initialized before the authentication middleware tries to use them. The error you are seeing (ArgumentNullException: Value cannot be null. (Parameter 'ClientId')) occurs because the ClientId (and possibly other required properties) are not set at application startup, so the OpenIdConnect middleware fails validation.

  Here's the correct approach for dynamic external login providers in ABP:

  1. Register Dynamic Options and Post-Configure Handler

     You must use .WithDynamicOptions<OpenIdConnectOptions, OpenIdConnectHandler>() after adding the OpenIdConnect provider, and register a post-configure handler to ensure dynamic properties are set before validation.

  context.Services.AddAuthentication()
         .AddOpenIdConnect("AzureOpenId", "Azure AD", options =>
         {
             options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
             options.RequireHttpsMetadata = false;
             options.SaveTokens = true;
             options.GetClaimsFromUserInfoEndpoint = true;
             options.Scope.Add("email");
             options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
             options.CallbackPath = configuration["AzureAd:CallbackPath"]; // Optional if dynamic
         })
         .WithDynamicOptions<OpenIdConnectOptions, OpenIdConnectHandler>(
             "AzureOpenId",
             options =>
             {
                 options.WithProperty(x => x.Authority);
                 options.WithProperty(x => x.ClientId);
                 options.WithProperty(x => x.ClientSecret, isSecret: true);
             }
         );
  
     context.Services.TryAddEnumerable(
         ServiceDescriptor.Singleton<
             IPostConfigureAccountExternalProviderOptions<OpenIdConnectOptions>,
             OpenIdConnectPostConfigureAccountExternalProviderOptions>());
  

  2. Implement the Post-Configure Handler

     This ensures that after dynamic properties are set, the options are re-validated:

  public class OpenIdConnectPostConfigureAccountExternalProviderOptions : IPostConfigureAccountExternalProviderOptions<OpenIdConnectOptions>
     {
         private readonly IEnumerable<IPostConfigureOptions<OpenIdConnectOptions>> _postConfigureOptions;
         public OpenIdConnectPostConfigureAccountExternalProviderOptions(IEnumerable<IPostConfigureOptions<OpenIdConnectOptions>> postConfigureOptions)
         {
             _postConfigureOptions = postConfigureOptions;
         }
         public Task PostConfigureAsync(string name, OpenIdConnectOptions options)
         {
             foreach (var configureOption in _postConfigureOptions)
             {
                 configureOption.PostConfigure(name, options);
             }
             return Task.CompletedTask;
         }
     }
  

  3. Do Not Set Required Properties to Null at Startup

     Do not leave ClientId, Authority, etc., unset at startup. The dynamic provider system will inject them at runtime, but the post-configure handler is required to ensure this happens after all dynamic properties are available.

  4. Summary

     • Use .WithDynamicOptions after .AddOpenIdConnect.
     • Register the IPostConfigureAccountExternalProviderOptions implementation.
     • Do not set required properties to null at startup; let the dynamic system handle them.

  This approach ensures that the OpenIdConnect middleware does not throw validation errors at startup and that your dynamic configuration is applied correctly.

  Sources:

  • https://abp.io/docs/latest/modules/account-pro

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  cvarela@ld created an hour ago

  Just to summarize in case this happens to anyone else, using .WithDynamicOptions after .AddOpenIdConnect in the AuthServer fixed the issue but you also need to add

  context.Services.AddDynamicExternalLoginProviderOptions<OpenIdConnectOptions>( "AzureOpenId", options => { options.WithProperty(x => x.Authority); options.WithProperty(x => x.ClientId); options.WithProperty(x => x.ClientSecret, isSecret: true); });

  in the ApiHost to be able to configure the provider in the application.

  Save Cancel