OpenID Connect authentication failed

[iauhammad]

Hello,

I am trying to follow what's outlined by the documentation in here https://docs.datalust.co/docs/azure-active-directory to try and add authentication to my Seq application. I've added http for my local version (generated certificate) and using Nginx as reverse proxy as well. However, after having all the configurations in place, I try to login, it goes to Azure AD, I can login successfully but then it redirects back to seq with the following error message: "OpenID Connect authentication failed with "No error provided" / "No extended description available".

This is the version of Seq I am currently using: datalust/seq:2021.2
And, here is an example of what my local URI looks like: https://seq.local:45341

Here is a snippet of what I can then see in the error log for the seq container:

System.Net.Http.HttpRequestException: Name or service not known (login.microsoftonline.com:443)

 ---> System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known

   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)

   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)

   at System.Net.Sockets.Socket.<ConnectAsync>g__WaitForConnectWithCancellation|283_0(AwaitableSocketAsyncEventArgs saea, ValueTask connectTask, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.DefaultConnectAsync(SocketsHttpConnectionContext context, CancellationToken cancellationToken)

   at System.Net.Http.ConnectHelper.ConnectAsync(Func`3 callback, DnsEndPoint endPoint, HttpRequestMessage requestMessage, CancellationToken cancellationToken)

   --- End of inner exception stack trace ---

   at System.Net.Http.ConnectHelper.ConnectAsync(Func`3 callback, DnsEndPoint endPoint, HttpRequestMessage requestMessage, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)

   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpClient.SendAsyncCore(HttpRequestMessage request, HttpCompletionOption completionOption, Boolean async, Boolean emitTelemetryStartStop, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

[19:51:03 ERR] OpenID Connect authentication failed with "No error provided" / "No extended description available"

System.Net.Http.HttpRequestException: Name or service not known (login.microsoftonline.com:443)

 ---> System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known

   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)

   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)

   at System.Net.Sockets.Socket.<ConnectAsync>g__WaitForConnectWithCancellation|283_0(AwaitableSocketAsyncEventArgs saea, ValueTask connectTask, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.DefaultConnectAsync(SocketsHttpConnectionContext context, CancellationToken cancellationToken)

   at System.Net.Http.ConnectHelper.ConnectAsync(Func`3 callback, DnsEndPoint endPoint, HttpRequestMessage requestMessage, CancellationToken cancellationToken)

   --- End of inner exception stack trace ---

   at System.Net.Http.ConnectHelper.ConnectAsync(Func`3 callback, DnsEndPoint endPoint, HttpRequestMessage requestMessage, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)

   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

   at System.Net.Http.HttpClient.SendAsyncCore(HttpRequestMessage request, HttpCompletionOption completionOption, Boolean async, Boolean emitTelemetryStartStop, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

[19:51:33 INF] Metrics sampled```

Can someone please advise what I might have missed in the setup or what I should be looking at specifically?

Thank you

[nblumhardt]

Hi Irfaan,

Thanks for your message. It looks like your Seq container can't reach the internet to complete the login flow - does this suggest any possible causes?

You can test whether the Seq container has any outbound access at all by attempting to install an app (in Settings > Apps), would be great to hear how you go.

Best regards,
Nick

[iauhammad]

Thanks for responding so quickly Nicholas.

I have actually tried to start again from scratch with all the setup and reconfigured everything step by step and now I have a different issue where I am getting invalid credentials. This is a bit more promising as it shows me that it's actually trying to authenticate now.
I am waiting on DevOps on my end to provide me with a new client secret and I'll then try to reconfigure everything again and give it another go.

[20:20:50 ERR] Exception occurred while processing message.

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException: Message contains error: 'invalid_client', error_description: 'AADSTS7000215: Invalid client secret is provided.

Trace ID: 190e5717-33c6-4926-ac93-61a3f31cd101

Correlation ID: 0f392df8-2aa6-4161-aff2-b4a29bbc1fab

Timestamp: 2021-10-25 20:20:50Z', error_uri: 'https://login.microsoftonline.com/error?code=7000215'.

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

[20:20:50 ERR] OpenID Connect authentication failed with "invalid_client" / "AADSTS7000215: Invalid client secret is provided.\r\nTrace ID: 190e5717-33c6-4926-ac93-61a3f31cd101\r\nCorrelation ID: 0f392df8-2aa6-4161-aff2-b4a29bbc1fab\r\nTimestamp: 2021-10-25 20:20:50Z"

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException: Message contains error: 'invalid_client', error_description: 'AADSTS7000215: Invalid client secret is provided.

Trace ID: 190e5717-33c6-4926-ac93-61a3f31cd101

Correlation ID: 0f392df8-2aa6-4161-aff2-b4a29bbc1fab

Timestamp: 2021-10-25 20:20:50Z', error_uri: 'https://login.microsoftonline.com/error?code=7000215'.

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()`

[iauhammad]

So minor update on this front.
After using an actual client secret I was able to complete the whole configuration steps for the Azure Active Directory auth.
Then It redirects me to the Seq login page which is expected behavior.
I was able to login with my Azure AD credentials and it took me back to the Seq application and I could see my logs.

However, after signing out and closing the browser, I wanted to try the flow again and went back to login.
And very disappointingly I keep getting authentication failed with the same errors in the log as I mentioned initially on this thread.

Can you confirm if this feature is deemed stable at this moment in time or there's still some tweaks being done to make it production ready?

[nblumhardt]

Hey Irfaan! Yes, this one's definitely stable and production-ready, used all over the place :-)

Do you mean that the container is still unable to resolve the login.microsoftonline.com hostname? I'm not sure why this would appear intermittently, but it sounds like network issue somewhere in the vicinity of your Docker container. There could be some kind of configuration problem I'm not spotting, though - would you mind emailing a screenshot of your AAD configuration (with the sensitive bits blocked/blurred out) to [email protected]? We can take a look 👍