IdentityServer3 works for Chrome but get invalid_c

问题:

I have a web portal that would use IdentityServer3 to authenticate the users. The user can log in without issues in Chrome but get Bad Request 400 - invalid_client when try to log in from Internet Explorer (Edge). Is there a setting I need to add in order for it to work with IE?

Identity Server setup:

  var wIdentityServerServiceFactory = new IdentityServerServiceFactory()
    .UseInMemoryClients(Clients.Get())
    .UseInMemoryScopes(Scopes.Get());

  var wDefaultCorsPolicyService = new DefaultCorsPolicyService
  {
    AllowAll = true
  };

  wIdentityServerServiceFactory.CorsPolicyService = new Registration<ICorsPolicyService>(wDefaultCorsPolicyService);

  var wLocalUserService = new CorporateUserService();
  wIdentityServerServiceFactory.UserService = new Registration<IUserService>(resolver => wLocalUserService);

  var wIdentityServerOptions = new IdentityServerOptions
  {
    SiteName = "Cae Security",
    SigningCertificate = Certificate.Get(),
    Factory = wIdentityServerServiceFactory,
    PluginConfiguration = ConfigurePlugins,
    EnableWelcomePage = false
  };

  appBuilder.UseIdentityServer(wIdentityServerOptions);

Identity Server Client Setup:

public static IEnumerable<Client> Get()
{
  return new List<Client>
  {
    new Client
    {
      ClientName = "Client Name",
      ClientId = "clientId",
      Enabled = true,
      ClientSecrets = new List<Secret>
      {
        new Secret("secret".Sha256())
      },
      Flow = Flows.ResourceOwner,
      AllowedScopes = new List<string>
      {
        "sample.com",
      },
      AccessTokenType = AccessTokenType.Jwt,
      AccessTokenLifetime = 3600,
      AbsoluteRefreshTokenLifetime = 86400,
      SlidingRefreshTokenLifetime = 43200,
      RefreshTokenUsage = TokenUsage.OneTimeOnly,
      RefreshTokenExpiration = TokenExpiration.Sliding,
    },
  };
}

回答1:

I have enabled logging and downloaded the IdentityServer3 source code to debug this issue.

Turns out that we can set the SecretParsers if we don't need client certificate validation. The problem goes away once I add the following to the IdentityServerServiceFactory()

  var wIdentityServerServiceFactory = new IdentityServerServiceFactory()
    .UseInMemoryClients(Clients.Get())
    .UseInMemoryScopes(Scopes.Get());

  wIdentityServerServiceFactory.SecretParsers = new List<Registration<ISecretParser>>
  {
    new Registration<ISecretParser, PostBodySecretParser>()
  };