OrchardCMS/OrchardCore · error · InvalidOperationException

The application details cannot be found.

Error message

The application details cannot be found.

What it means

In AccessController.Authorize, after OpenIddict validates the authorize request, the controller looks up the OpenID application record by the request's client_id via IOpenIdApplicationManager.FindByClientIdAsync. If no application matches, it throws InvalidOperationException('The application details cannot be found.') instead of continuing the authorization flow.

Solutions

  1. Register or re-create the OpenID application in the tenant's admin UI (OpenID Connect > Applications) with the exact client_id the client sends.
  2. Fix the client_id configured in the consuming application to match an existing application record.
  3. Verify you are hitting the correct tenant/host; applications are per-tenant.
  4. Apply the setup recipe or migration that defines the application on the target environment.

Example fix

// before
client_id: "my-app"
// after (must equal an existing OpenID application's ClientId in this tenant)
client_id: "orchard-admin-app"
Defensive patterns

Strategy: validation

Validate before calling

// Before starting the authorize flow, verify the client_id exists
var apps = await adminClient.GetOpenIdApplicationsAsync(tenantUrl);
bool exists = apps.Any(a => a.ClientId == clientId);
if (!exists) throw new InvalidOperationException($"Client '{clientId}' is not registered.");

Type guard

bool ClientExists(string clientId, IEnumerable<OpenIdAppSummary> apps) =>
    !string.IsNullOrWhiteSpace(clientId) && apps?.Any(a => a.ClientId == clientId) == true;

Try / catch

try
{
    return await AuthorizeAsync(clientId);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("application details cannot be found"))
{
    logger.LogError(ex, "Unknown client_id {ClientId}", clientId);
    return BadRequest("Unknown client_id.");
}

Prevention

When it happens

Trigger: GET/POST to the authorize endpoint with a client_id that has no corresponding registered OpenID application in the current tenant (deleted application, wrong tenant, or a client_id typo).

Common situations: Client configured in the app points at the wrong Orchard tenant; the OpenID application was deleted or renamed after the client was deployed; running the same flow on a fresh environment where applications were not recreated (no recipe/migration).

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/95b1fc9d62481f1c. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.OpenId/Controllers/AccessController.cs:117

            // To avoid endless login endpoint -> authorization endpoint redirects, a special temp data entry is
            // used to skip the challenge if the user agent has already been redirected to the login endpoint.
            //
            // Note: this flag doesn't guarantee that the user has accepted to re-authenticate. If such a guarantee
            // is needed, the existing authentication cookie MUST be deleted AND revoked (e.g using ASP.NET Core
            // Identity's security stamp feature with an extremely short revalidation time span) before triggering
            // a challenge to redirect the user agent to the login endpoint.
            TempData["IgnoreAuthenticationChallenge"] = true;

            return Challenge(new AuthenticationProperties
            {
                RedirectUri = Request.PathBase + Request.Path + QueryString.Create(
                    Request.HasFormContentType ? Request.Form : Request.Query),
            });
        }

        var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??
            throw new InvalidOperationException("The application details cannot be found.");

        var authorizations = await _authorizationManager.FindAsync(
            subject: result.Principal.GetUserIdentifier(),
            client: await _applicationManager.GetIdAsync(application),
            status: Statuses.Valid,
            type: AuthorizationTypes.Permanent,
            scopes: request.GetScopes()).ToListAsync();

        switch (await _applicationManager.GetConsentTypeAsync(application))
        {
            case ConsentTypes.External when authorizations.Count == 0:
                return Forbid(new AuthenticationProperties(new Dictionary<string, string>
                {
                    [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.ConsentRequired,
                    [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
                        "The logged in user is not allowed to access this client application.",
                }), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

View on GitHub (pinned to 4306c0717f)