{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2595","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2595/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2595/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2595/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/2595","id":357892368,"node_id":"MDU6SXNzdWUzNTc4OTIzNjg=","number":2595,"title":"External authentication failing on iOS 12","user":{"login":"ryanmendoza","id":3503832,"node_id":"MDQ6VXNlcjM1MDM4MzI=","avatar_url":"https://avatars0.githubusercontent.com/u/3503832?v=4","gravatar_id":"","url":"https://api.github.com/users/ryanmendoza","html_url":"https://github.com/ryanmendoza","followers_url":"https://api.github.com/users/ryanmendoza/followers","following_url":"https://api.github.com/users/ryanmendoza/following{/other_user}","gists_url":"https://api.github.com/users/ryanmendoza/gists{/gist_id}","starred_url":"https://api.github.com/users/ryanmendoza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryanmendoza/subscriptions","organizations_url":"https://api.github.com/users/ryanmendoza/orgs","repos_url":"https://api.github.com/users/ryanmendoza/repos","events_url":"https://api.github.com/users/ryanmendoza/events{/privacy}","received_events_url":"https://api.github.com/users/ryanmendoza/received_events","type":"User","site_admin":false},"labels":[{"id":507816050,"node_id":"MDU6TGFiZWw1MDc4MTYwNTA=","url":"https://api.github.com/repos/IdentityServer/IdentityServer4/labels/bug%20report","name":"bug report","color":"b60205","default":false}],"state":"open","locked":false,"assignee":{"login":"brockallen","id":649492,"node_id":"MDQ6VXNlcjY0OTQ5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"assignees":[{"login":"brockallen","id":649492,"node_id":"MDQ6VXNlcjY0OTQ5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/milestones/39","html_url":"https://github.com/IdentityServer/IdentityServer4/milestone/39","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/milestones/39/labels","id":3300204,"node_id":"MDk6TWlsZXN0b25lMzMwMDIwNA==","number":39,"title":"2.3","description":"next feature release","creator":{"login":"leastprivilege","id":1454075,"node_id":"MDQ6VXNlcjE0NTQwNzU=","avatar_url":"https://avatars0.githubusercontent.com/u/1454075?v=4","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"open_issues":15,"closed_issues":51,"state":"open","created_at":"2018-04-26T05:23:07Z","updated_at":"2018-10-02T12:29:49Z","due_on":"2018-10-31T07:00:00Z","closed_at":null},"comments":21,"created_at":"2018-09-07T02:06:05Z","updated_at":"2018-10-03T20:09:25Z","closed_at":null,"author_association":"NONE","body":"Please only use the issue tracker for bug reports and/or feature requests. For general security questions, or free or commercial support options do __not__ use the issue tracker and instead see [here](https://identityserver4.readthedocs.io/en/release/intro/support.html) for more details.\r\n\r\nFor bug reports,  include the relevant log files related to your issue. See here how to enable [logging](https://identityserver4.readthedocs.io/en/release/topics/logging.html). Delete this line once you have.\r\n\r\nFinally, please keep the issue concise and to the point. If you paste in more code than the text for the issue you are reporting then we will most likely not read it. \r\n\r\n### Issue / Steps to reproduce the problem\r\n\r\nExternal authentication failing in iOS 12 Safari.\r\n\r\nI am seeing failures across all iOS 12 (beta) devices when authenticating using an external provider. There is no issue with iOS <11 or mobile Firefox, Chrome (nor desktop/Android browsers).\r\n\r\n` var result = await HttpContext.AuthenticateAsync(IdentityServer4.IdentityServerConstants.ExternalCookieAuthenticationScheme);` is failing for devices running Safari in iOS 12. Tracing the request, it looks like `idsrv.external` cookie is empty when redirecting from `signin-oidc` endpoint to the `externalcallback` endpoint, but is populated if you simply refresh the browser on the `externalcallback` page.\r\n\r\nIf you refresh the errored /externalcallback page, it will continue on and work fine.\r\n\r\nI understand that iOS 12 is a beta OS, but it is very close to release and it would be nice to get this figured out.\r\n\r\n**Update:** I was able to replicate this in Safari 12.0 for macOS Mojave as well. My guess is this may be more related to Microsoft authentication libraries...\r\n\r\n### Relevant parts of the log file\r\n\r\n```\r\n2018-09-07 01:58:39.674 +00:00 [Error] Microsoft.AspNetCore.Server.Kestrel: Connection id \"0HLGKCKUC9350\", Request id \"0HLGKCKUC9350:0000000C\": An unhandled exception was thrown by the application.\r\nSystem.Exception: External authentication error\r\n   at IdentityServer.UI.AccountController.ExternalLoginCallback() in C:\\Users\\Ryan\\Projects\\Identity Server\\src\\IdentityServer\\UI\\Account\\AccountController.cs:line 192\r\n   at Microsoft.AspNetCore.Mvc.Internal.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)\r\n   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeActionMethodAsync()\r\n   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeNextActionFilterAsync()\r\n   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Rethrow(ActionExecutedContext context)\r\n   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeInnerFilterAsync()\r\n   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter()\r\n   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)\r\n   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()\r\n   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()\r\n   at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)\r\n   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)\r\n   at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events)\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)\r\n   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)\r\n   at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context)\r\n   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)\r\n   at IdentityServer.Startup.<>c.<<Configure>b__6_0>d.MoveNext() in C:\\Users\\Ryan\\Projects\\Identity Server\\src\\IdentityServer\\Startup.cs:line 213\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.Invoke(HttpContext httpContext)\r\n   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)\r\n\r\n```\r\n\r\n```\r\n        /// <summary>\r\n        /// Post processing of external authentication\r\n        /// </summary>\r\n        [HttpGet]\r\n        public async Task<IActionResult> ExternalLoginCallback()\r\n        {\r\n            // read external identity from the temporary cookie\r\n            var result = await HttpContext.AuthenticateAsync(IdentityServer4.IdentityServerConstants.ExternalCookieAuthenticationScheme);\r\n\r\n            if (result.Succeeded != true)\r\n            {\r\n                throw new Exception(\"External authentication error\");\r\n            }\r\n            ...\r\n         }\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/426782935","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/2595#issuecomment-426782935","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2595","id":426782935,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjc4MjkzNQ==","user":{"login":"brockallen","id":649492,"node_id":"MDQ6VXNlcjY0OTQ5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2018-10-03T20:09:25Z","updated_at":"2018-10-03T20:09:25Z","author_association":"MEMBER","body":"I see @NickyM also setting the `None` setting on the correlation cookies for the external providers. Can anyone confirm if that is also necessary for this iOS 12 browser issue? I did not see that as necessary from the [Microsoft announcement](https://github.com/aspnet/Announcements/issues/318)."}}
{"actor":{"display_login":"brockallen"}}