SignalR HubConnectionContext name always empty.

[tinmac]

Hello there,

Maybe @BrennanConroy or any kind soul would take a look at this.

Im trying to [Authorize] a SignalR Method using IdentityServer4. I have followed the guidance in the Auth docs

I have a minimal git repo here to demonstrate the problem. HubConnectionContext is always empty of any claims for the user so I cant set the NameUserIdProvider to the 'name' claim as directed in the docs.

The access token always comes in via the Authorization header, which I don't understand why as isnt it suppose to be in the query string for bearer tokens?

The solution has three projects and the client is a WPF app (very minimal).

Debug message (logging) goes to the output window.

Why wont this work, I have followed the docs but I dont understand why HubConnectionContext doesn't contain the claims.
Thanks

[BrennanConroy]

Have you tried putting [Authorize("Bearer")] on the hub class?

[BrennanConroy]

Do you know that the token you're giving the HubConnection is valid? Is your OnMessageReceived callback being run and getting the token? Can you provide debug logs from the server?

[tinmac]

Hi, the IS4 token is passed to the wpf client (after successful IS4 login). The wpf client lists the claims (shown in log output below). So at this point there is a good token with claims.

The problem starts when the token is used by the wpf client to connect to the SignalR hub. OnMessageReceived fires on the hub and gets the token from the Authorization header (see log), so there is a token at this point.

Since you asked me to move the [Authorize] attribute from the method to the class it simply wont authenticate (401) so now ive had a sleep and this is a new day I can see that this token is probably not being accepted by the SignalR hub but I don't know how to debug what's going on in the SIgnalR middleware to see why the token is being refused (or if its being refused). Does that make any sense?

Wpf Client.....
Hello Bob Smith UN/PW accepted by IS4, token issued: eyJ...XStBVD_RNA  which has the following Claims:
s_hash = k2LHy1C-ZGSl_GeFfsQERw
sid = 8A70BE45CE54D62DDAED343F09102AC6
sub = 04c6c1c2-34b3-4c37-86d9-c4961bef2032
idp = local
amr = pwd
given_name = Bob
name = Bob Smith
family_name = Smith
website = http://bob.com
preferred_username = bob
email = BobSmith@email.com
email_verified = true

Wpf Client.....
Connecting to SyncHub @ http://localhost:54787/  - Token: eyJ...XStBVD_RNA

Sync Hub.......
Event... OnMessageReceived... Token fouund in Headers[Authorization] : Bearer eyJ...XStBVD_RNA

Exception thrown: 'System.Net.Http.HttpRequestException' in System.Private.CoreLib.dll
Wpf Client.....
Response status code does not indicate success: 401 (Unauthorized).

[tinmac]

Hi @BrennanConroy

So after a day of debugging, I found I needed to either validate the audience or disable it, so I disabled it like so:

services.AddAuthentication("Bearer")
            .AddJwtBearer("Bearer", options =>
            { 
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateAudience = false
                };

I also enabled logging in the WPF app for SignalR and could see the error in question:

Failed to start connection. Error getting negotiation response

With the following logging output..

Microsoft.AspNetCore.SignalR.Client.HubConnection: Debug: Registering handler for client method 'CallAll'.
Microsoft.AspNetCore.SignalR.Client.HubConnection: Debug: Starting HubConnection.
Microsoft.AspNetCore.Http.Connections.Client.HttpConnection: Debug: Starting HttpConnection.
Microsoft.AspNetCore.Http.Connections.Client.HttpConnection: Debug: Establishing connection with server at 'http://localhost:5050/sighub'.
Sync Hub.......
Event... OnMessageReceived... Token fouund in Headers[Authorization] : Bearer eyJ...E3-KlJsPFA

Microsoft.AspNetCore.Http.Connections.Client.Internal.LoggingHttpMessageHandler: Warning: Unsuccessful HTTP response 401 return from POST 'http://localhost:5050/sighub/negotiate?negotiateVersion=1'.
Microsoft.AspNetCore.Http.Connections.Client.HttpConnection: Error: Failed to start connection. Error getting negotiation response from 'http://localhost:5050/sighub'.

System.Net.Http.HttpRequestException: Response status code does not indicate success: 401 (Unauthorized).
at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
at Microsoft.AspNetCore.Http.Connections.Client.HttpConnection.NegotiateAsync(Uri url, HttpClient httpClient, ILogger logger, CancellationToken cancellationToken)
Microsoft.AspNetCore.Http.Connections.Client.HttpConnection: Debug: Skipping dispose, connection is already disposed.
Exception thrown: 'System.Net.Http.HttpRequestException' in System.Private.CoreLib.dll
Wpf Client..... exception: Response status code does not indicate success: 401 (Unauthorized).

So this is over my head but I can see its a negotiation issue, have you any thoughts on this?

[BrennanConroy]

I don't know how to debug what's going on in the SIgnalR middleware

Auth doesn't run in the SignalR middleware, you're just hitting the normal auth middleware.

I found I needed to either validate the audience or disable it

Are you getting a token from a different server? It looks like you're passing a token from one server to another and not configuring the second server to know about those tokens. I'm definitely no auth expert, but it seems like your server hosting SignalR needs to be configured to be aware of the service providing the token.

[tinmac]

@BrennanConroy

Its resolved.

I was adding code in the hubs startup onMessageReceived to pluck the access token out of the Authorization header and set the context.token with said token. This was not correct and was the cause of the Error getting negotiation response, once I removed the offending code all worked fine.

Thank you for your most helpful guidance, your suggestions pointed me in the right direction.