Bug: OIDC via WindowsSSO Fails with Invalid_Scope or Unknown Scope

Version Affected: 21.04 and earlier
Bug Number: Not provided in source
Bug Status: Closed - Fixed
Fixed in Version(s): 9.3 HF25, 19.07.01 HF32, 20.06 HF9, 21.04 HF1

 

Overview

An OIDC realm configured to log in via WindowsSSO (or another Begin Site) can fail with Invalid_Scope or Unknown scope, even though the requested scopes are correctly configured on the realm.

Cause

The URL parameters are being URL-encoded twice: once when the request reaches SecureAuth.aspx, and again when it's passed on to WindowsSSO.aspx (or whichever Begin Site is selected). This causes the requested scopes to be seen as a single combined scope instead of separate ones. The Debug log shows an entry similar to this during the authentication attempt:

Message="[ScopeValidator].[ValidateScopesWithRealm]: Scope 'profile+email+openid' is not defined in realm configuration."
...
Message="[AuthorizeEndpointHandler].[ValidateParameters]: Unknown scope."

Resolution / Workaround

Upgrade to one of the following hotfix levels or later: 9.3 HF25, 19.07.01 HF32, 20.06 HF9, or 21.04 HF1.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.