{"record":{"id":"c4bf06fd04a6ac34","repo":"elsa-workflows/elsa-core","slug":"the-identity-provider-rejected-the-authentication-request","errorCode":null,"errorMessage":"The identity provider rejected the authentication request.","messagePattern":"The identity provider rejected the authentication request\\.","errorType":"exception","errorClass":"OpenIdConnectAuthenticationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs","lineNumber":82,"sourceCode":"        var query = new Dictionary<string, string>\n        {\n            [\"response_type\"] = \"code\",\n            [\"client_id\"] = settings.ClientId,\n            [\"redirect_uri\"] = GetCallbackUri(context.Connection, context.Transaction.Purpose).AbsoluteUri,\n            [\"scope\"] = string.Join(' ', settings.Scopes),\n            [\"state\"] = context.CorrelationState,\n            [\"nonce\"] = nonce,\n            [\"code_challenge\"] = CreateCodeChallenge(verifier),\n            [\"code_challenge_method\"] = \"S256\"\n        };\n\n        return new(WithQuery(metadata.AuthorizationEndpoint, query), state);\n    }\n\n    public async ValueTask<ExternalAuthenticationResult> AuthenticateCallbackAsync(ExternalCallbackContext context, CancellationToken cancellationToken = default)\n    {\n        if (TryGetParameter(context.Parameters, \"error\", out _))\n            throw new OpenIdConnectAuthenticationException(\"The identity provider rejected the authentication request.\");\n\n        if (!TryGetParameter(context.Parameters, \"state\", out var state) || !FixedTimeEquals(state, context.CorrelationState))\n            throw new OpenIdConnectAuthenticationException(\"The identity provider callback could not be correlated.\");\n\n        var settings = await GetSettingsAsync(context.Connection.Connection.AdapterSettings, cancellationToken);\n        var metadata = await ResolveMetadataAsync(settings, cancellationToken);\n        var adapterState = ReadAdapterState(context.Transaction.ProtectedPayload);\n        if (adapterState is not null && !string.Equals(adapterState.Issuer, metadata.Issuer, StringComparison.Ordinal))\n            throw new OpenIdConnectAuthenticationException(\"The identity provider callback issuer did not match the initiated request.\");\n\n        var idToken = await ExchangeCodeAsync(settings, metadata, context, adapterState?.CodeVerifier, cancellationToken);\n        var principal = await ValidateIdTokenAsync(idToken, settings, metadata, cancellationToken);\n        var nonce = principal.FindFirst(\"nonce\")?.Value;\n        var expectedNonce = context.Transaction.ProviderNonce ?? adapterState?.Nonce;\n        if (string.IsNullOrWhiteSpace(expectedNonce) || !FixedTimeEquals(nonce, expectedNonce))\n            throw new OpenIdConnectAuthenticationException(\"The identity provider nonce did not match the initiated request.\");\n\n        var issuer = principal.FindFirst(\"iss\")?.Value ?? metadata.Issuer;","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs#L64-L100","documentation":"During the OpenID Connect authorization-code callback, AuthenticateCallbackAsync first checks the query parameters returned by the identity provider. If the provider returned an 'error' parameter (per RFC 6749 section 4.1.2.1), the adapter throws this OpenIdConnectAuthenticationException, meaning the provider itself rejected the end user's authentication or authorization request.","triggerScenarios":"Calling AuthenticateCallbackAsync with context.Parameters containing an 'error' key (e.g. error=access_denied, error=invalid_request) from the redirect URI callback.","commonSituations":"User cancels the login page; the provider rejects the request due to a misconfigured redirect URI, unregistered client, or missing user consent; the user's account is locked or lacks access to the application.","solutions":["Log the actual 'error' and 'error_description' query parameters from the callback URL to see why the provider rejected the request.","Check the provider's app registration: client_id, redirect URI, and requested scopes must all be registered.","Surface a friendly message to the end user explaining the login was cancelled or denied, and retry the sign-in flow via the adapter's initiation endpoint."],"exampleFix":"// inspect the callback to diagnose\nvar error = Request.Query[\"error\"].ToString();\nvar description = Request.Query[\"error_description\"].ToString();\nlogger.LogWarning(\"OIDC callback rejected: {Error} - {Description}\", error, description);\nreturn Challenge(); // restart the login flow","handlingStrategy":"try-catch","validationCode":"if (Request.Query.ContainsKey(\"error\")) { var desc = Request.Query[\"error_description\"].ToString(); return Results.Problem($\"Login rejected: {Request.Query[\\\"error\\\"]} {desc}\"); }","typeGuard":null,"tryCatchPattern":"try { var result = await adapter.AuthenticateCallbackAsync(context); } catch (OpenIdConnectAuthenticationException ex) { logger.LogWarning(ex, \"OIDC callback error\"); return Challenge(); }","preventionTips":["Log error and error_description query parameters from every callback.","Validate redirect URIs and scopes in the provider app registration before deploying.","Provide users a friendly 'sign-in was cancelled' path and a retry button."],"tags":["openid-connect","authentication","oauth"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}