Troubleshooting: OIDC Metadata Returns an HTML Error Along with Valid JSON Output

Version Affected: All
 
 

Overview

The OpenID Connect (OIDC) metadata endpoint returns an HTML error appended after the valid JSON output, when the request does not include a User-Agent header. For example:

curl https://idp.example.com/secureauthXX/.well-known/openid-configuration -H "User-Agent:"

returns the expected metadata JSON, immediately followed by:

<html> An error in the authentication has occurred. Please Try Again. <br> If the error persists, please contact your Administrator. </html>

Cause

Turning off custom errors reveals the underlying exception:

[NullReferenceException]: Object reference not set to an instance of an object.
at Global_asax.DisallowsSameSiteNone(String userAgent)
at Global_asax.Application_PreSendRequestHeaders(Object sender, EventArgs e)
at System.Web.HttpApplication.SendResponseExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

The realm's Global.asax.vb file (in D:\SecureAuth\SecureAuthXX\) contains a customized DisallowsSameSiteNone function that inspects the request's User-Agent header:

Public Shared Function DisallowsSameSiteNone(ByVal userAgent As String) As Boolean
If userAgent.Contains("CPU iPhone OS 12") OrElse userAgent.Contains("iPad; CPU OS 12") Then
Return True
End If
If userAgent.Contains("Macintosh; Intel Mac OS X 10_14") AndAlso userAgent.Contains("Version/") AndAlso userAgent.Contains("Safari") Then
Return True
End If
If userAgent.Contains("Chrome/5") OrElse userAgent.Contains("Chrome/6") Then
Return True
End If
If (Tools.ReadAppSettings("SameSiteUserAgentRegex").IsNotNullOrEmpty()) Then
Dim regExRules as String() = Tools.ReadAppSettings("SameSiteUserAgentRegex").Split( New Char() {";"})
Return regExRules.Any(Function(rule) Regex.IsMatch(userAgent, rule, RegexOptions.None))
End If
Return False
End Function

Sending a request with an empty User-Agent header passes a null userAgent value into this function. Since the function calls userAgent.Contains(...) without first checking for null, this throws the NullReferenceException shown above, which produces the appended HTML error.

Resolution

Remove the DisallowsSameSiteNone function from Global.asax.vb, or replace the file with the default Global.asax.vb file.

Special Considerations

If replacing Global.asax.vb results in syntactical errors, also replace Global.asax with its default file.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.