Troubleshooting: OAuth2/OIDC URI Generates a 401 Error on WinSSO Realms

Version Affected: All
 
 

Overview

A realm using Windows Single Sign-On (WinSSO) returns an HTTP 401 Unauthorized error when a client accesses one of its OAuth 2.0/OpenID Connect (OIDC) endpoints -- for example, https://SecureAuthIdP/SecureAuth#/.well-known/openid-configuration.

 

Cause

OAuth 2.0/OIDC endpoints are meant to be reachable using anonymous authentication, but a realm with Windows Authentication enabled blocks anonymous requests to all of its endpoints by default -- including its OAuth 2.0/OIDC endpoints -- which produces the 401 error. The realm's OidcAuthorize.aspx endpoint is the one exception, since it's meant to use the realm's Windows Authentication credentials to identify the user.

Resolution:

The fix depends on which endpoint is affected.

For the .well-known/openid-configuration endpoint:

1. Create a folder named .well-known inside the affected realm's folder -- for example, D:\Secureauth\SecureAuth#\.well-known. Windows Explorer will not let you create a folder whose name starts with a period, so create it from PowerShell or the command line instead:

# PowerShell
Set-Location D:\Secureauth\SecureAuth#
New-Item .well-known -ItemType Directory

# Command Prompt
CD D:\Secureauth\SecureAuth#
MD .well-known

2. Inside the new .well-known folder, create a web.config file containing the following, which enables anonymous authentication for just that folder:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
      <security>
        <authentication>
          <anonymousAuthentication enabled="true" />
        </authentication>
      </security>
    </system.webServer>
    <system.web>
      <identity impersonate="false" />
    </system.web>
</configuration>

For the realm's other OAuth 2.0/OIDC endpoints:

The remaining OAuth 2.0/OIDC endpoint files can each be switched to anonymous authentication directly in IIS Manager, since they don't have the same restriction on folder names starting with a period:

1. Open IIS Manager and navigate to the realm.
2. In Content View, select one of the endpoint files -- for example, OidcToken.aspx.
3. Switch to Features View.
4. Open Authentication.

5. Set Anonymous Authentication to Enabled.
6. Repeat for each of the realm's other OAuth 2.0/OIDC endpoints: OidcToken.aspx, OidcUserInfo.aspx, OidcEndSession.aspx, OidcCheckSession.aspx, OAuthintrospect.aspx, and OAuthRevocate.aspx. Do not change OidcAuthorize.aspx, since it's meant to use the realm's Windows Authentication credentials.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.