title: Azure Active Directory ASP.NET Core 3.1 "We couldn't sign you in. Please try again." Are we missing any configurations?
body: <p>We are using .NET core 3.1, Azure AD , and Visual Studio Connected Services templates which attempt to generate the startup.cs file.</p>
  
  <p>Are we not setting something in the config?  We are not using client secret, but maybe that's the problem?  Connected Services did generate one.</p>
  
  <p><strong>Startup.cs</strong></p>
  
  <pre><code> public class Startup
      {
  
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
              {
                  // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                  options.CheckConsentNeeded = context =&gt; true;
                  options.MinimumSameSitePolicy = SameSiteMode.None;
              });
  
              services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
                      .AddAzureAD(options =&gt; Configuration.Bind("AzureAd", options));
  
              services.Configure&lt;OpenIdConnectOptions&gt;(AzureADDefaults.OpenIdScheme, options =&gt;
              {
                  options.Authority = options.Authority + "/v2.0/";         // Microsoft identity platform
  
                  options.TokenValidationParameters.ValidateIssuer = false; // accept several tenants (here simplified)
              });
  
  
  
              services.AddMvc();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
  
  
              app.UseHttpsRedirection();
  
              app.UseRouting();
  
              app.UseAuthorization();
              app.UseAuthentication();
              //The new UseEndpoints method
              app.UseEndpoints(endpoints =&gt;
              {             
                  endpoints.MapControllers();
              });
          }
      }
  }
  </code></pre>
  
  <p><strong>AppSettings.json</strong></p>
  
  <pre><code>{
    "Logging": {
      "LogLevel": {
        "Default": "Information",
        "Microsoft": "Warning",
        "Microsoft.Hosting.Lifetime": "Information"
      }
    },
    "AllowedHosts": "*",
    "AzureAd": {
      "ClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "Domain": "macrowhq.onmicrosoft.com",
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "CallbackPath": "/signin-oidc",
      "ClientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
      "AppIDURL": "https://xxxxxxxx.onmicrosoft.com/WebApplication11",
      "ConfigView": "MVC"
    }
  }
  </code></pre>
  
  <p><strong>Launch Settings.json</strong></p>
  
  <pre><code>{
    "$schema": "http://json.schemastore.org/launchsettings.json",
    "iisSettings": {
      "windowsAuthentication": false,
      "anonymousAuthentication": true,
      "iisExpress": {
        "applicationUrl": "http://localhost:61517",
        "sslPort": 44363
      }
    },
    "profiles": {
      "IIS Express": {
        "commandName": "IISExpress",
        "launchBrowser": true,
        "launchUrl": "https://localhost:44363/weatherforecast",
        "environmentVariables": {
          "ASPNETCORE_ENVIRONMENT": "Development"
        }
      },
      "WebApplication11": {
        "commandName": "Project",
        "launchBrowser": true,
        "launchUrl": "weatherforecast",
        "applicationUrl": "https://localhost:5001;http://localhost:5000",
        "environmentVariables": {
          "ASPNETCORE_ENVIRONMENT": "Development"
        }
      }
    }
  }
  </code></pre>
  
  <p><strong>500 on sign-in oidc</strong>
  <a href="https://i.stack.imgur.com/ye4gM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ye4gM.png" alt="enter image description here"></a></p>
  
  <p><strong>We saw the login screen for our domain</strong></p>
  
  <p>The error  "We couldn't sign you in. Please try again." only happened after we entered the userid/password (yes we are sure it was correct.)</p>
  
  <p>The odd thing is that the user account does show signed in despite this message.</p>
  
  <p><a href="https://i.stack.imgur.com/jNRSM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jNRSM.png" alt="enter image description here"></a></p>
  
  <pre><code>Request URL: https://localhost:44363/signin-oidc
  Request Method: POST
  Status Code: 500 
  Remote Address: [::1]:44363
  Referrer Policy: strict-origin-when-cross-origin
  date: Fri, 06 Mar 2020 21:56:30 GMT
  server: Microsoft-IIS/10.0
  status: 500
  x-powered-by: ASP.NET
  :authority: localhost:44363
  :method: POST
  :path: /signin-oidc
  :scheme: https
  accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  accept-encoding: gzip, deflate, br
  accept-language: en-US,en;q=0.9
  cache-control: no-cache
  content-length: 1681
  content-type: application/x-www-form-urlencoded
  cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Lp55qWi8TlPh0rBkxAxUdnRkP-8BQvFEB24nS5JppFP4F8...
          .AspNetCore.Correlation.AzureADOpenID.SGSLll-jiFohbpdZx0poFsgBfko79OWPcNnHcA7gEXs=N...
          .AspNetCore.OpenIdConnect.Nonce.CfDJ8Lp55qWi8TlPh0rBkxAxUdnofEIcTW_vXX1wIOPuDZ5u_dF...
          .AspNetCore.Correlation.AzureADOpenID.2eJUPEWi45vkhK12OGyyEGfTVDnHQj-ydAmkECan5ZE=N...
          .AspNetCore.AzureADCookie=CfDJ8Lp55qWi8TlPh0rBkxAxUdlMAHAFXphv1Kp9khZBbtL5kMZf6lLLU...
  
  origin: https://login.microsoftonline.com
  pragma: no-cache
  referer: https://login.microsoftonline.com/
  sec-fetch-dest: document
  sec-fetch-mode: navigate
  sec-fetch-site: cross-site
  upgrade-insecure-requests: 1
  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
  id_token: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IkhsQzBSMTJza3hOWjFXKdKmhGqmuL0CnCHYkt8QtFdlCQfsjGeQZ...
  state: CfDJ8Lp55qWi8TlPh0rBkxAxUdnJ07dNioFne0krEAmVmwXBA-5pCOswFvE6Kt0oIPcckWGfljAPW3b8XnTXCY5-dGLhxrS8fI0A...
  session_state: b4d30d59-0e31-4645-9876-e002bd1c7...
  </code></pre>