Azure / Azure/static-web-apps

Incorrect OpenID Configuration results in 500

Open
#1,714 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

Due to a misconfiguration of a custom identity provider it is possible to leave a Static Web App in a non-functional state with no feedback as to why the site isn't loading. It simply returns a "500" error state. This issue has been opened to request a more graceful failure state, and to provide a reference to anyone else who runs into the same problem.

Here's an example `auth` configuration based on using the a new Entra External ID tenant. Using this will result in a 500 internal server error.

``` JSON
{
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"ext": {
"registration": {
"clientIdSettingName": "OPENID_CLIENT_ID",
"clientCredential": {
"clientSecretSettingName": "OPENID_CLIENT_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://[tenant].onmicrosoft.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]"
}
},
"login": {
"nameClaimType": "name",
"scopes": ["openid", "email", "profile"],
"loginParameterNames": []
}
}
}
}
}
}
```

The failure is that the `wellKnownOpenIdConfiguration` is:

`https://[tenant].onmicrosoft.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]`

But it should be:

`https://[tenant].ciamlogin.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]`

This is very subtly wrong (it should be `ciamlogin.com` not `onmicrosoft.com`). The `onmicrosoft.com` version doesn't resolve to a valid domain. As a result, the Static Web App fails with a `500 Internal Server Error`.

**To Reproduce**
Steps to reproduce the behavior:
1. Set up a static web app and add a configuration with the incorrect `wellKnownOpenIdConfiguration`.
2. Visit the site
3. See a 500 internal server error

**Expected behavior**
There doesn't seem to be a good failure path for issues with the static web app config. I'd suggest updating the 500 message for Static Web Apps to indicate that there's a misconfiguration in the auth area.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.