Incorrect OpenID Configuration results in 500
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
Due to a misconfiguration of a custom identity provider it is possible to leave a Static Web App in a non-functional state with no feedback as to why the site isn't loading. It simply returns a "500" error state. This issue has been opened to request a more graceful failure state, and to provide a reference to anyone else who runs into the same problem.
Here's an example `auth` configuration based on using the a new Entra External ID tenant. Using this will result in a 500 internal server error.
``` JSON
{
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"ext": {
"registration": {
"clientIdSettingName": "OPENID_CLIENT_ID",
"clientCredential": {
"clientSecretSettingName": "OPENID_CLIENT_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://[tenant].onmicrosoft.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]"
}
},
"login": {
"nameClaimType": "name",
"scopes": ["openid", "email", "profile"],
"loginParameterNames": []
}
}
}
}
}
}
```
The failure is that the `wellKnownOpenIdConfiguration` is:
`https://[tenant].onmicrosoft.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]`
But it should be:
`https://[tenant].ciamlogin.com/[tenant].onmicrosoft.com/v2.0/.well-known/openid-configuration?appid=[appId]`
This is very subtly wrong (it should be `ciamlogin.com` not `onmicrosoft.com`). The `onmicrosoft.com` version doesn't resolve to a valid domain. As a result, the Static Web App fails with a `500 Internal Server Error`.
**To Reproduce**
Steps to reproduce the behavior:
1. Set up a static web app and add a configuration with the incorrect `wellKnownOpenIdConfiguration`.
2. Visit the site
3. See a 500 internal server error
**Expected behavior**
There doesn't seem to be a good failure path for issues with the static web app config. I'd suggest updating the 500 message for Static Web Apps to indicate that there's a misconfiguration in the auth area.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.