IdentityServer4.AccessTokenValidation update to 1.0.1-rc4 causes 500 on resource server about identityserver4.accesstokenvalidation HOT 12 CLOSED

System.InvalidOperationException: You must either set a ScopeName or set an introspection HTTP handler
at IdentityModel.AspNetCore.OAuth2Introspection.OAuth2IntrospectionMiddleware..ctor(RequestDelegate next, IOptions1 options, UrlEncoder urlEncoder, ILoggerFactory loggerFactory, IDistributedCache cache) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.Extensions.Internal.ActivatorUtilities.ConstructorMatcher.CreateInstance(IServiceProvider provider) at Microsoft.Extensions.Internal.ActivatorUtilities.CreateInstance(IServiceProvider provider, Type instanceType, Object[] parameters) at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass3_0.b__0(RequestDelegate next) at Microsoft.AspNetCore.Builder.Internal.ApplicationBuilder.Build() at IdentityServer4.AccessTokenValidation.IdentityServerAuthenticationMiddleware..ctor(RequestDelegate next, IApplicationBuilder app, CombinedAuthenticationOptions options, ILogger1 logger)
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Extensions.Internal.ActivatorUtilities.ConstructorMatcher.CreateInstance(IServiceProvider provider)
at Microsoft.Extensions.Internal.ActivatorUtilities.CreateInstance(IServiceProvider provider, Type instanceType, Object[] parameters)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass3_0.b__0(RequestDelegate next)
at Microsoft.AspNetCore.Builder.Internal.ApplicationBuilder.Build()
at Microsoft.AspNetCore.Hosting.Internal.WebHost.BuildApplication()

from identityserver4.accesstokenvalidation.

you need to set the ApiName

from identityserver4.accesstokenvalidation.

the exception message is wrong though.

from identityserver4.accesstokenvalidation.

thanks

from identityserver4.accesstokenvalidation.

Thats only needed for introspection though

from identityserver4.accesstokenvalidation.

Problem comes from the https://github.com/IdentityModel/IdentityModel.AspNetCore.OAuth2Introspection
If you want, I could fix this and do a pull request

Greetings Damien

from identityserver4.accesstokenvalidation.

Fixed by validating that if one is set that the other also needs to be set.

from identityserver4.accesstokenvalidation.

@brockallen Why did you close this, bug is that the Exception message in incorrect as @leastprivilege said.

from identityserver4.accesstokenvalidation.

We fixed the message on the dev branch

from identityserver4.accesstokenvalidation.

@leastprivilege @brockallen Also noticed that you re-implemented my pull request yourself, why ClientId and not ApiName, otherwise the user will not know that the ApiName needs to be set.

from identityserver4.accesstokenvalidation.

we do the error handling now in the top level middleware. In the middle of releasing rc4-update1. Will start to make more sense in an hour ;)

from identityserver4.accesstokenvalidation.

ah ok, thanks for the feedback

Greetings Damien

from identityserver4.accesstokenvalidation.