[Bug] : NullReferenceException when acquiring a token for a user in a server-side Blazor app. #157

gwgrubbs · 2020-05-12T22:50:37Z

Which Version of Microsoft Identity Web are you using ?
Microsoft Identity Web 0.1.2-preview

Where is the issue?

Web App
- Sign-in users
- [ X] Sign-in users and call web APIs
Web API
- Protected web APIs (Validating tokens)
- Protected web APIs (Validating scopes)
- Protected web APIs call downstream web APIs
Token cache serialization
- [X ] In Memory caches
- Session caches
- Distributed caches

This is a new application that is a server-side Razor application calling a protected Web API. The application works as expected locally, but fails with a NullReferenceException when running as an Azure App Service. The failure occurs when trying to retrieve a token for a user (GetAccessTokenForUserAsync). The request to get a token for the user occurs in a lower-level HttpClient service when retrieving the token to add as an Authorization header. The HttpClient service is injected into the Blazor page (@Inject). As a test, I've added code to the OnGet() method of the Blazor page (which runs on first access of a page from the site), and the same code works as expected both locally and in Azure (GetAccessTokenForUserAsync returns a valid token with no exception).

I have confirmed that the following values are correctly configured:

TenantId
ClientId
ClientSecret

I have confirmed the application has been registered correctly in Azure AD with valid value(s) for:

RedirectURIs
Scopes

Given I can run the application locally with no exceptions, I don't think I have missing or invalid configuration. I also don't think this issue has anything to do with the Web API itself, this exception occurs simply trying to get a token from the cache and/or from MSAL prior to communication with the (protected) Web API.

Repro

Startup.cs

services
	.AddSignIn(
		openIdOptions => Configuration.Bind("AppAzureAd", openIdOptions),
		identityOptions => Configuration.Bind("AppAzureAd", identityOptions)
	)
	.AddWebAppCallsProtectedWebApi(
		Configuration.GetSection("Api:Scopes").Get<List<string>>(),
		openIdOptions => Configuration.Bind("AppAzureAd", openIdOptions),
		identityOptions =>
		{
			Configuration.Bind("AppAzureAd", identityOptions);
			identityOptions.EnablePiiLogging = environment.IsDevelopment();
		}
	)
	.AddInMemoryTokenCaches()
	.AddTokenAcquisition();

Blazor Page method that works as expected (no exceptions, token acquired) on first page request:

public async Task<IActionResult> OnGet()
{
	if (!User.Identity.IsAuthenticated)
		return Challenge();

	try
	{
		var token = await tokenAcquisition.GetAccessTokenForUserAsync(apiOptions.Value.Scopes);
	}
	catch (MsalUiRequiredException ex)
	{
		//can't get a token from the token store, MUST assume a sign-out path as requests to API will NOT be authenticated
		logger.LogError(ex, ex.Message);
		await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
		return Challenge();
	}

	return Page();
}

HttpClient setting the authorization header (GetAccessTokenForUserAsync works locally, but fails in Azure):

private async Task AddAuthorizationHeaderAsync(HttpRequestMessage request)
{
	request.Headers.Authorization = new AuthenticationHeaderValue(JwtBearerDefaults.AuthenticationScheme, await AcquireTokenAsync());
}

private async Task<string> AcquireTokenAsync()
{
	string token;
	try
	{
		token = await tokenAcquisition.GetAccessTokenForUserAsync(apiOptions.Value.Scopes);
	}
	catch (MsalUiRequiredException ex)
	{
		//can't get a token from the token store, MUST assume a sign-out path as requests to API will NOT be authenticated
		logger.LogError(ex, ex.Message);
		throw;
	}

	return token;
}

Expected behavior
I expect to be able to acquire a valid token for the user at any point during the "request" lifecycle.

Actual behavior
The following stack trace:

[2020-05-12T21:55:47.258Z] Error: System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.Identity.Web.TokenAcquisition.CreateRedirectUri()
   at Microsoft.Identity.Web.TokenAcquisition.BuildConfidentialClientApplicationAsync()
   at Microsoft.Identity.Web.TokenAcquisition.GetOrBuildConfidentialClientApplicationAsync()
   at Microsoft.Identity.Web.TokenAcquisition.GetAccessTokenForUserAsync(IEnumerable`1 scopes, String tenant)
   ...

Possible Solution
At a minimum, better exception handling that leads me to the actual error.

The text was updated successfully, but these errors were encountered:

bgavrilMS · 2020-05-13T13:06:00Z

Possibly a duplicate of #136

@gwgrubbs - do you have a stack trace?

gwgrubbs · 2020-05-13T15:46:45Z

I don't think it's a duplicate as the stack trace indicates a different point in the stack for the exception.

Stack trace for #136:

at Microsoft.Identity.Web.HttpContextExtensions.GetTokenUsedToCallWebAPI(HttpContext httpContext) in D:\a\1\s\src\Microsoft.Identity.Web\HttpContextExtensions.cs:line 29

Stack trace for my issue (included in "Actual behavior" of submitted ticket):

at Microsoft.Identity.Web.TokenAcquisition.CreateRedirectUri()

From review of #136, I thought the issue may be related to this line in CreateRedirectUri method of TokenAcquisition.cs:

var request = CurrentHttpContext.Request;

where a root issue of a null HttpContext may be the similarity between #136 and this issue.

jaimunday · 2020-05-28T07:38:09Z

I also have this same issue (works perfectly locally but Azure Web App fails).
I notice it was tagged for the new preview but removed now? Do you know which preview this would be added into instead please?

jmprieur · 2020-05-28T08:38:46Z

@gwgrubbs

why did you add AddTokenAcquisition
I'm assuming that you have not activated the App Services authentication? (you should not)

gwgrubbs · 2020-05-28T19:33:56Z

@jmprieur

I thought AddTokenAcquisition was a requirement for use with this package to support fetching and auto-refresh of AD tokens (to add as an authorization header for requests to a protected Web API). Please correct me if I am wrong.
"App Services authentication" is "off" for the app service in Azure.

I do think there is a case with Blazor that may be an issue across the board. As described in the issue report, everything works as expected in the OnGet() method of the Blazor page; i.e. I can use GetAccessTokenForUserAsync and successfully retrieve an AD token. This is because this is the original request to the server, at which time HttpContext is available. In the service methods that I have where it doesn't work, the methods are executed via requests made over a web socket where HttpContext is not available. So I'm concluding that anything in Microsoft.Identity.Web that depends on HttpContext will not work in Blazor applications when the requests are made over web socket.

The reason (I believe) it works locally is that HttpContext is available for subsequent requests by the way local development environments work - it fails in Azure by the way browsers communicate via web socket to the App Service.

I also implemented a rather clunky workaround where in the OnGet() method I set a property on the model with the value of the AD Token that I then inject as a CascadingParameter into the components, which is then passed to my service method as a method arg. A lot of plumbing/passing of the AD Token where it would be ideal to use Microsoft.Identity.Web to request a token when/where needed.

isaacrlevin · 2020-07-09T23:15:28Z

@gwgrubbs you are right with the bit about HttpContext. The workaround is to have a service that caches the token for you. I am doing this here

https://github.com/isaacrlevin/PresenceLight/blob/main/src/PresenceLight.Worker/Startup.cs#L69

This is using Microsoft.Identity.Client so it won't work here directly. Need to modify the process to get the token but it IS doable

jennyf19 · 2020-07-19T20:34:36Z

@gwgrubbs we believe this has been fixed with this branch, if you want to try it out and get back to us. Thank you.

dansmitt · 2020-07-20T14:04:35Z

@jennyf19 I still get a NullReferenceException at TokenAcquisition.cs:line 220

jmprieur · 2020-07-20T14:12:15Z

@schmid37 : could you please provide the stack trace?
or/and a repro?
thanks

cc: @jennyf19

jennyf19 · 2020-07-20T19:27:52Z

@gwgrubbs I'm unable to repro this issue. We now have web app blazor templates, which you can try as well. Do you have repro you can share?

gwgrubbs · 2020-07-20T20:33:10Z

@jennyf19 - I pulled your branch and corrected breaking changes.

I reviewed the sample project "BlazorServerSideWeb-CSharp", specifically to look at Startup.cs to see how to "correctly" configure Microsoft.Identity.Web[.UI]. Here's what I have in my Startup.cs:

services.AddMicrosoftWebAppAuthentication(Configuration, "AppAzureAd")
	.AddMicrosoftWebAppCallsWebApi(Configuration, Configuration.GetSection("Api:Scopes").Get<List<string>>(), "AppAzureAd")
	.AddInMemoryTokenCaches();

When running with assembly references to those from your branch, everything works fine locally. However, running in Azure I get the following (as reported in Chrome console):

[2020-07-20T20:14:12.249Z] Error: System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.Identity.Web.TokenAcquisition.BuildConfidentialClientApplicationAsync() in D:\src\microsoft-identity-web\src\Microsoft.Identity.Web\TokenAcquisition.cs:line 337
   at Microsoft.Identity.Web.TokenAcquisition.GetOrBuildConfidentialClientApplicationAsync() in D:\src\microsoft-identity-web\src\Microsoft.Identity.Web\TokenAcquisition.cs:line 326
   at Microsoft.Identity.Web.TokenAcquisition.GetAccessTokenForUserAsync(IEnumerable`1 scopes, String tenant, String userFlow) in D:\src\microsoft-identity-web\src\Microsoft.Identity.Web\TokenAcquisition.cs:line 211
   at OBFUSCATED.Web.App.Service.AppService.AddAuthorizationHeaderAsync(HttpRequestMessage request, String accessToken) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 90
   at OBFUSCATED.Web.App.Service.AppService.<>c__DisplayClass4_0`1.<<GetAsync>b__0>d.MoveNext() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 38
--- End of stack trace from previous location where exception was thrown ---
   at OBFUSCATED.Net.Http.HttpClientService.SendRequestAsync[TReturn](HttpRequestMessage message, Func`2[] configure) in D:\src\OBFUSCATED\src\OBFUSCATED\Net\Http\HttpClientService.cs:line 149
   at OBFUSCATED.Net.Http.HttpClientService.GetAsync[TReturn](Action`1 urlPathBuilder, Func`2[] configure) in D:\src\OBFUSCATED\src\OBFUSCATED\Net\Http\HttpClientService.cs:line 47
   at OBFUSCATED.Web.App.Service.AppService.GetAsync[T](String accessToken, Action`1 urlPathBuilder) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 38
   at OBFUSCATED.Web.App.Service.AssetService.GetPageAsync(String accessToken, PageModel page, String filterToFundId) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AssetService.cs:line 22
   at OBFUSCATED.Web.App.Pages.Asset.FetchCurrentPage() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Pages\Asset.razor:line 160
   at OBFUSCATED.Web.App.Pages.Asset.OnInitializedAsync() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Pages\Asset.razor:line 96
   at Microsoft.AspNetCore.Components.ComponentBase.RunInitAndSetParametersAsync()

In my service, I'm using the following code to acquire a token, which caused the exception:

await tokenAcquisition.GetAccessTokenForUserAsync(apiOptions.Value.Scopes);

tokenAcquisition is an instance of ITokenAcquisition injected in the service which was configured using the service extension methods as shown in Startup.cs above. Looking at line 337 of Microsoft.Identity.Web.TokenAcquisition,
its trying to resolve HttpContext: CurrentHttpContext.Request. HttpContext is null at this point as the "request" is over web socket.

gwgrubbs · 2020-07-20T20:38:24Z

@jennyf19 I still get a NullReferenceException at TokenAcquisition.cs:line 220

@jennyf19, I can see where line 218 in your branch has CurrentHttpContext.User, which may be the source of the NullReferenceException @schmid37 is experiencing.

jennyf19 · 2020-07-20T23:42:46Z

Thanks @gwgrubbs, did you try with the current master branch? Changes were made to not use the CurrentHttpContext.User where possible. There is an Optional claims principal representing the user that can be passed in.

gwgrubbs · 2020-07-21T02:23:07Z

@jennyf19 I just pulled master branch (18c4950), and I'm still getting the exception; now getting it where @schmid37 was seeing it:

blazor.server.js:15 [2020-07-21T01:45:11.004Z] Error: System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.Identity.Web.TokenAcquisition.GetAccessTokenForUserAsync(IEnumerable`1 scopes, String tenant, String userFlow, ClaimsPrincipal user) in D:\src\microsoft-identity-web\src\Microsoft.Identity.Web\TokenAcquisition.cs:line 220
   at OBFUSCATED.Web.App.Service.AppService.AddAuthorizationHeaderAsync(HttpRequestMessage request, String accessToken) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 90
   at OBFUSCATED.Web.App.Service.AppService.<>c__DisplayClass4_0`1.<<GetAsync>b__0>d.MoveNext() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 38
--- End of stack trace from previous location where exception was thrown ---
   at OBFUSCATED.Core.Net.Http.HttpClientService.SendRequestAsync[TReturn](HttpRequestMessage message, Func`2[] configure) in D:\src\OBFUSCATED\src\OBFUSCATED.Core\Net\Http\HttpClientService.cs:line 149
   at OBFUSCATED.Core.Net.Http.HttpClientService.GetAsync[TReturn](Action`1 urlPathBuilder, Func`2[] configure) in D:\src\OBFUSCATED\src\OBFUSCATED.Core\Net\Http\HttpClientService.cs:line 47
   at OBFUSCATED.Web.App.Service.AppService.GetAsync[T](String accessToken, Action`1 urlPathBuilder) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\AppService.cs:line 38
   at OBFUSCATED.Web.App.Service.EntityService.GetPageAsync(String accessToken, PageModel page) in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Service\EntityService.cs:line 23
   at OBFUSCATED.Web.App.Pages.Entity.FetchCurrentPage() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Pages\Entity.razor:line 252
   at OBFUSCATED.Web.App.Pages.Entity.OnInitializedAsync() in D:\src\OBFUSCATED\src\OBFUSCATED.Web.App\Pages\Entity.razor:line 90
   at Microsoft.AspNetCore.Components.ComponentBase.RunInitAndSetParametersAsync()

microsoft-identity-web/src/Microsoft.Identity.Web/TokenAcquisition.cs

Lines 220 to 226 in 18c4950

    
           accessToken = await GetAccessTokenOnBehalfOfUserFromCacheAsync( 
        
               _application, 
        
               user ?? CurrentHttpContext.User, 
        
               scopes, 
        
               tenant, 
        
               userFlow) 
        
               .ConfigureAwait(false);

I do see the optional claims principal in the method signature, the problem is I have no access to this value in the context of a web socket - not without a bunch of hoops and tying in to the oidc events (as @isaacrlevin did). My hope was you guys could figure out the lift between DI, scoped services, token caching, etc. to be able to manage all of this internally.

jennyf19 · 2020-07-21T22:21:26Z

@gwgrubbs thanks for the reply. we are working on a solution for this. will keep you posted here.

jennyf19 · 2020-07-22T03:23:45Z

@gwgrubbs Can you try this branch it should handle the user context for you...proof of concept inspired by this sample

dansmitt · 2020-07-22T10:20:05Z

@jennyf19 works so far :)

dansmitt · 2020-07-22T14:50:19Z

@jennyf19 Sometimes I get an Exception:

blazor.server.js:19 [2020-07-22T14:44:30.900Z] Error: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Identity.Web.HttpContextExtensions.GetTokenUsedToCallWebAPI(HttpContext httpContext) in C:\src\Microsoft.Identity.Web\HttpContextExtensions.cs:line 29
at Microsoft.Identity.Web.TokenAcquisition.GetAccessTokenForUserAsync(IEnumerable`1 scopes, String tenant, String userFlow, ClaimsPrincipal user) in C:\src\Microsoft.Identity.Web\TokenAcquisition.cs:line 258

When I delete the cookies and do a reload, Everything works fine. Is this a problem related to the actual chanages?

The CurrentHttpContext at line 258 is null.

gwgrubbs · 2020-07-22T15:47:30Z

@jennyf19 I concur with @schmid37 that it is working so far. I haven't experienced the issue you see, but I think I know what the issue is. if you have a stale cookie and call GetAccessTokenOnBehalfOfUserFromCacheAsync, line 243 will throw a MsalUiRequiredException exception (expecting you to then initiate some redirect to signin to re-authenticate or something). In the catch block, line 258 will cause the result you see, as the rule is CurrentHttpContext will always be null.

jennyf19 · 2020-07-22T15:56:12Z

@gwgrubbs & @schmid37 glad to hear it's working, thanks for confirming. we are aware of the redirect issue, it's because blazor doesn't have the challenge method, so we're trying to come up with a work around.

dansmitt · 2020-07-23T10:44:36Z

@gwgrubbs & @schmid37 glad to hear it's working, thanks for confirming. we are aware of the redirect issue, it's because blazor doesn't have the challenge method, so we're trying to come up with a work around.

@jennyf19 how can we track this? Is there an existing open issue?

jennyf19 · 2020-07-23T15:05:40Z

@schmid37 this is the only issue for tracking at the moment. we're trying to get this into our next release (today or tomorrow), but if we run out of time (we have an external deadline), then I will close this and open a new issue, ping you both here so you know. sound good?

dansmitt · 2020-07-23T15:08:31Z

@jennyf19 sounds good to me! Thx for the support 💪🏻

jennyf19 · 2020-07-23T16:50:58Z

@schmid37 @gwgrubbs here's the new issue for the second part of the call. will still try to get this in the current milestone if possible.

pmaytak · 2020-07-25T04:12:46Z

@gwgrubbs @jaimunday @isaacrlevin @schmid37

This is included in Microsoft Identity Web 0.2.1-preview release.

jennyf19 added bug Something isn't working token cache serialization - in memory cache labels May 12, 2020

jennyf19 added this to the 0.1.4-preview milestone May 15, 2020

jmprieur added Blazor web app labels May 22, 2020

jmprieur removed this from the 0.1.4-preview milestone May 27, 2020

jmprieur added this to the [6] Support new scenarios milestone Jun 26, 2020

jmprieur modified the milestones: [6] Support new scenarios, 0.2.1-preview Jul 15, 2020

henrik-me modified the milestones: 0.2.1-preview, [2] .NET5 preview 8 & Visual Studio readiness Jul 17, 2020

jmprieur mentioned this issue Jul 19, 2020

Investigation on removing the need for IHttpContext and fixing 4 related bugs #321

Closed

jennyf19 mentioned this issue Jul 19, 2020

Jennyf/http investigation #339

Merged

jennyf19 added the In progress label Jul 19, 2020

jennyf19 added the blocked label Jul 20, 2020

jennyf19 added the need repro label Jul 20, 2020

jennyf19 assigned jmprieur Jul 21, 2020

jennyf19 mentioned this issue Jul 23, 2020

fix null ref w/sign-in with blazor #359

Merged

jmprieur added the fixed label Jul 23, 2020

pmaytak removed In progress blocked labels Jul 25, 2020

pmaytak closed this as completed Jul 25, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Bug] : NullReferenceException when acquiring a token for a user in a server-side Blazor app. #157

[Bug] : NullReferenceException when acquiring a token for a user in a server-side Blazor app. #157

gwgrubbs commented May 12, 2020

bgavrilMS commented May 13, 2020

gwgrubbs commented May 13, 2020

jaimunday commented May 28, 2020

jmprieur commented May 28, 2020

gwgrubbs commented May 28, 2020

isaacrlevin commented Jul 9, 2020

jennyf19 commented Jul 19, 2020

dansmitt commented Jul 20, 2020

jmprieur commented Jul 20, 2020

jennyf19 commented Jul 20, 2020

gwgrubbs commented Jul 20, 2020 •

edited

Loading

gwgrubbs commented Jul 20, 2020

jennyf19 commented Jul 20, 2020 •

edited

Loading

gwgrubbs commented Jul 21, 2020

jennyf19 commented Jul 21, 2020

jennyf19 commented Jul 22, 2020

dansmitt commented Jul 22, 2020

dansmitt commented Jul 22, 2020

gwgrubbs commented Jul 22, 2020

jennyf19 commented Jul 22, 2020

dansmitt commented Jul 23, 2020

jennyf19 commented Jul 23, 2020

dansmitt commented Jul 23, 2020

jennyf19 commented Jul 23, 2020

pmaytak commented Jul 25, 2020

[Bug] : NullReferenceException when acquiring a token for a user in a server-side Blazor app. #157

[Bug] : NullReferenceException when acquiring a token for a user in a server-side Blazor app. #157

Comments

gwgrubbs commented May 12, 2020

bgavrilMS commented May 13, 2020

gwgrubbs commented May 13, 2020

jaimunday commented May 28, 2020

jmprieur commented May 28, 2020

gwgrubbs commented May 28, 2020

isaacrlevin commented Jul 9, 2020

jennyf19 commented Jul 19, 2020

dansmitt commented Jul 20, 2020

jmprieur commented Jul 20, 2020

jennyf19 commented Jul 20, 2020

gwgrubbs commented Jul 20, 2020 • edited Loading

gwgrubbs commented Jul 20, 2020

jennyf19 commented Jul 20, 2020 • edited Loading

gwgrubbs commented Jul 21, 2020

jennyf19 commented Jul 21, 2020

jennyf19 commented Jul 22, 2020

dansmitt commented Jul 22, 2020

dansmitt commented Jul 22, 2020

gwgrubbs commented Jul 22, 2020

jennyf19 commented Jul 22, 2020

dansmitt commented Jul 23, 2020

jennyf19 commented Jul 23, 2020

dansmitt commented Jul 23, 2020

jennyf19 commented Jul 23, 2020

pmaytak commented Jul 25, 2020

gwgrubbs commented Jul 20, 2020 •

edited

Loading

jennyf19 commented Jul 20, 2020 •

edited

Loading