Troubleshooting: OpenID server_error "An Unexpected Error Occurred"

Version Affected: All -- the version range differs by cause, noted individually below.
 
 

Overview

When attempting to use an OpenID realm, authentication fails with server_error: An unexpected error occurred. There are two independent causes with different underlying signatures:

• See Cause 1 - The scope parameter is missing from the OIDC authorization request
• See Cause 2 - The OIDC realm also has Windows SSO and Transformation Engine enabled, and the Debug Logs show a NullReferenceException in MFA.WebControls.ContextUser

These causes are not related, so a fix for one will not resolve the other.

 

In this article

• Cause 1: Missing scope Parameter
• Cause 2: OIDC Realm With Windows SSO and Transformation Engine Enabled

Cause 1: Missing scope Parameter

This can happen when the scope parameter is missing from the request, as shown below. If the steps below do not resolve the issue, check the Audit log for the specific cause.

Resolution 1:

To resolve this:

1. Copy the full address from the browser's address bar, including the query string. It will look similar to:

https://Secureauth.example.com/SecureAuth123/Authorized/OidcAuthorize.aspx?response_type=code&client_id=123f65a1232212389c952123b56cea16&redirect_uri=https%3a%2f%2fexample.oidc.com%2fapi%2fskill%2flink%2fMY3RMUMMC68PZ&state=A2SAAEAEMFNg7l

2. Check whether scope is present in the query string. In the example above, it is missing.
3. If it is missing, edit the OpenID Connect (OIDC) server configuration so it requests the scope.

Cause 2: OIDC Realm With Windows SSO and Transformation Engine Enabled

Applies to versions 20.06 and later.

After enabling Windows SSO on an OIDC realm created in the Classic interface, authentication fails with the same server_error: An error was encountered. message, but the Debug Logs show a different signature at the time of the error (the domain and username below are an example; they will be specific to the end user logging in):

Message="MFA.WebControls.ContextUser.GetUser: DOMAIN\User"

Message="LDAPMembershipProvider.GetUser: user name: DOMAIN\User"

Message="[AuthorizeEndpoint].[ProcessConsent]: Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.NullReferenceException: Object reference not set to an instance of an object.
at MFA.WebControls.ContextUser.get_Comment()

This happens because the Profile lookup uses the DOMAIN\User format rather than just the User format, and since no user named DOMAIN\User exists in the Datastore, the lookup fails and throws the error. This only happens when the OIDC SSO realm also has Transformation Engine enabled. 

Resolution 2:

• If Transformation Engine is not required for this realm, disable it, wait for replication between appliances, and try logging in again.
• If Transformation Engine is required, migrate the realm to a New Experience realm, since this issue does not occur in New Experience realms.

If Transformation Engine is required and migrating the realm to New Experience is not possible, use the following workaround instead.

Workaround: See SecureAuth's Web Service (Multi-Data-Store) Configuration Guide for instructions on setting up a WebService configuration.

1. Set up an Authentication realm and enable WebService.
2. On the Authentication realm's Data tab, select a Profile Property that is not in use and map it to the sAMAccountName AD attribute.

3. On the OIDC realm's Data tab, change the Multi-Datastore Membership Configuration setting to point to the Authentication realm. When selecting it, click Add Realm from Another Server (even if the Authentication realm is on the local server) and add it in the following format (DOMAIN is an example; use the domain seen in your own error message):

SecureAuth11|DOMAIN

4. On the OIDC realm's Post Authentication tab, scroll down to the Open ID Connect Access / ID Token Claims section and map the Profile Property chosen in step 2 to the sub claim.

The SSO-enabled OIDC realm should now work with Transformation Engine enabled. For related WinSSO/OIDC configuration guidance, see OAuth2/OIDC URI Generates a 401 Error on WinSSO Realms.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.