Troubleshooting: OIDC Authorization Code Fails to Decrypt Between Internal and DMZ IdP Servers

Version Affected: 19.x and later
 
 

Overview

With an OIDC Authorization Code flow, an External OIDC application always exchanges its authorization code with the DMZ-facing IdP server for the Access and ID Token -- even when the user actually logged in against the internal IdP server. Starting in 19.x, this exchange can fail when tested internally, and the external server's debug log shows Authorization code failed decryption. For other ways the Authorization Code exchange can fail, see Troubleshooting: OIDC/OAuth "Authorization Code Does Not Match or Has Already Been Used" Error.

Cause

Starting in 19.x, SecureAuth increased the security used to create the Authorization Code. Decrypting it now requires the internal and external IdP servers to use the same ConfigPassPhrase value -- if the two servers' web.config files have different values, the external server can't decrypt a code issued by the internal server.

Resolution:

Use the same ConfigPassPhrase value on both the internal and external boxes:

1. On the external box, decrypt the web.config.
2. Open web.config and find ConfigPassPhrase, then copy its value.
3. On the internal box, back up the current web.config (for example, in D:\SecureAuth\SecureAuth123\).
4. On the internal box, decrypt the web.config.
5. Open web.config and find ConfigPassPhrase.
6. Replace the value with the one copied in step 2.
7. Save the web.config.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.