Ytukyg

I have a strange problem for an application I put in production.

The app is a Asp.net 4.7.2 Webapi protected by an embedded Identity Server 3 instance plus an instance of swagger for documentation.

I need only client authentication so I choose client credential as flow.

These are the main configuration data for the application.

new Client {

    ClientName = "GDPR Logger Client",

    Enabled = true,

    ClientId = "gdpr_logger",

    Flow = Flows.ClientCredentials,

    AccessTokenType = AccessTokenType.Reference,

    ClientSecrets = new List<Secret> {

        new Secret("secret".Sha256())

    },

    AllowedScopes = new List<string> {

        "write"

    },

    AccessTokenLifetime = 30

}



app.Map("/auth", auth => {

    var options = new IdentityServerOptions {

        SiteName = "GDPR LOGGER Authentication Server",

        SigningCertificate = LoadCertificate(),

        RequireSsl = true,

        Factory = new IdentityServerServiceFactory()

            .UseInMemoryUsers(new List<InMemoryUser>())

            .UseInMemoryClients(Clients.Get())

            .UseInMemoryScopes(Scopes.Get());

    };

    auth.UseIdentityServer(options);

});



private static X509Certificate2 LoadCertificate() {

    certificateFilePath = HttpContext.Current.Server.MapPath(ConfigurationManager.AppSettings["RelativeCertPath"]);

    X509Certificate2 cert = new X509Certificate2();

    cert.Import(certificateFilePath, "GDPRLoggerCert",           X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet);

    return cert;}

In my local machine all work perfect, but as soon I put it on my server the Identity Server stop working.

When I try to get the access token for the client (with client_credentials flow) Identity Server respond me with invalid_client when I POST to https://{my-server}/auth/connect/token all data as application/x-www-form-urlencoded content in the request grant_type=client_credentials&client_id=gdpr_logger&client_secret=secret&scope=write.

2018-11-20 09:14:20,035 [244] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController - Start token request

2018-11-20 09:14:20,066 [244] DEBUG IdentityServer3.Core.Validation.ClientSecretValidator - Start client validation

2018-11-20 09:14:20,066 [244] DEBUG IdentityServer3.Core.Validation.BasicAuthenticationSecretParser - Start parsing Basic Authentication secret

2018-11-20 09:14:20,082 [244] DEBUG IdentityServer3.Core.Validation.PostBodySecretParser - Start parsing for secret in post body

2018-11-20 09:14:20,082 [244] DEBUG IdentityServer3.Core.Validation.PostBodySecretParser - No secret in post body found

2018-11-20 09:14:20,082 [244] DEBUG IdentityServer3.Core.Validation.X509CertificateSecretParser - Start parsing for X.509 certificate

2018-11-20 09:14:20,082 [244] DEBUG IdentityServer3.Core.Validation.X509CertificateSecretParser - client_id is not found in post body

2018-11-20 09:14:20,082 [244] INFO  IdentityServer3.Core.Validation.SecretParser - Parser found no secret

2018-11-20 09:14:20,082 [244] INFO  IdentityServer3.Core.Validation.ClientSecretValidator - No client secret found

2018-11-20 09:14:20,082 [244] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController - End token request

2018-11-20 09:14:20,097 [244] INFO  IdentityServer3.Core.Results.TokenErrorResult - Returning error: invalid_client

If I specify client_id and client_secret as Basic Authentication Header Identity server respond me with unsupported_grant_type.

2018-11-20 09:08:36,113 [323] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController - Start token request

2018-11-20 09:08:36,144 [323] DEBUG IdentityServer3.Core.Validation.ClientSecretValidator - Start client validation

2018-11-20 09:08:36,144 [323] DEBUG IdentityServer3.Core.Validation.BasicAuthenticationSecretParser - Start parsing Basic Authentication secret

2018-11-20 09:08:36,144 [323] DEBUG IdentityServer3.Core.Validation.SecretParser - Parser found secret: BasicAuthenticationSecretParser

2018-11-20 09:08:36,144 [323] INFO  IdentityServer3.Core.Validation.SecretParser - Secret id found: gdpr_logger

2018-11-20 09:08:36,160 [323] DEBUG IdentityServer3.Core.Validation.SecretValidator - Secret validator success: HashedSharedSecretValidator

2018-11-20 09:08:36,160 [323] INFO  IdentityServer3.Core.Validation.ClientSecretValidator - Client validation success

2018-11-20 09:08:36,176 [323] INFO  IdentityServer3.Core.Validation.TokenRequestValidator - Start token request validation

2018-11-20 09:08:36,363 [323] ERROR IdentityServer3.Core.Validation.TokenRequestValidator - Grant type is missing.

 {

  "ClientId": "gdpr_logger",

  "ClientName": "GDPR Logger Client",

  "Raw": {}

}

2018-11-20 09:08:36,363 [323] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController - End token request

2018-11-20 09:08:36,379 [323] INFO  IdentityServer3.Core.Results.TokenErrorResult - Returning error: unsupported_grant_type

As you can see in the last log in Raw it seems the data in post are not read/picked up from Identity Server.

I cannot understand what is the problem.

My Server manager solved the problem.

The ModSecurity (in Plesk inside the Web Application Firewall) for a second level domain as in my case blocked the post data because is againt its rules.

Disabling or editing the rules solved the problem.