AADSTS54005: OAuth2 Authorization code was already redeemed

[TejendraPrasad]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.12.4

Web app

Sign-in users

Web API

Protected web APIs (validating scopes/roles)

Token cache serialization

In-memory caches

Description

.NET CORE 6 MVC

I have upgrade package from 2.11.0 to [2.12.4].. i get below errro

Reproduction steps

User login and it goes infinite loop microsoft.login

Error message

[08:48:36] [Error] [Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler] Exception occurred while processing message.
MSAL.NetCore.4.54.1.0.MsalUiRequiredException:
ErrorCode: invalid_grant
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.
Trace ID: ce41467c-55bb-40e1-ab95-67f439011200
Correlation ID: a4e9ecc3-e73f-4938-a67c-144d76c96f0e
Timestamp: 2023-07-13 07:48:39Z
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByAuthorizationCodeParameters authorizationCodeParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Web.TokenAcquisition.AddAccountToCacheFromAuthorizationCodeAsync(AuthCodeRedemptionParameters authCodeRedemptionParameters)
at Microsoft.Identity.Web.TokenAcquisitionAspNetCore.AddAccountToCacheFromAuthorizationCodeAsync(AuthorizationCodeReceivedContext context, IEnumerable`1 scopes, String authenticationScheme)
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunAuthorizationCodeReceivedEventAsync(OpenIdConnectMessage authorizationResponse, ClaimsPrincipal user, AuthenticationProperties properties, JwtSecurityToken jwt)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
StatusCode: 400
ResponseBody: {"error":"invalid_grant","error_description":"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. "}
Headers: Cache-Control: no-store, no-cache

Id Web logs

No response

Relevant code snippets

services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
                   .EnableTokenAcquisitionToCallDownstreamApi()
                   .AddInMemoryTokenCaches();

 services.Configure<CookieAuthenticationOptions>(CookieAuthenticationDefaults.AuthenticationScheme, options =>
              {
                  options.Cookie.SameSite = SameSiteMode.None;
                  options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
                  options.Cookie.HttpOnly = true;
                  options.Cookie.IsEssential = true;

                  options.Events.OnSigningIn = async (context) =>
                  {
                      context.Properties.IsPersistent = false;

                      await Task.CompletedTask;
                  };

                  options.AccessDeniedPath = new PathString("/Error/UnAuthorized");
              });

 services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
                {
                    options.MetadataAddress = metadataAddress;
                    options.Authority = authority;
                    options.ClientId = azureAdOptions.ClientId;

                    options.Events.OnTicketReceived = async context =>
                    {
                        context.Properties.IsPersistent = false;
                        await Task.CompletedTask;
                    };

                    var existingOnTokenValidatedHandler = options.Events.OnTokenValidated;

                    options.Events.OnTokenValidated = async context =>
                    {
                        await existingOnTokenValidatedHandler(context);
   await Task.FromResult(0);
                    };
                    options.Events.OnRemoteFailure = async context =>
                    {   await Task.FromResult(0);
                    };
                    options.Events.OnAuthenticationFailed = async (context) =>
                    {  await Task.FromResult(0);
                    };
                });

Regression

2.11.0

Expected behavior

User should be logged in, currently its going infinite loop.

[TejendraPrasad]

I user below code to get access token for secured API

public async Task<string> GetAccessTokenForApplicationAsync(string scope) { return await _tokenAcquisition.GetAccessTokenForAppAsync(scope);}

[AndreErb]

Exactly the same error here.
In all our Blazor-Apps / .NET 6 / MS.Identity.Web V2.13.4

This is becoming critical, as restarting the Web-App is the only solution.
Additionally, users sometimes have too delete their cookies, after the App has been restarted, cause the failing logins create many cookies behind the scenes. So this makes it additional painful.

@jmprieur @jennyf19
I have a strong feeling, that this problem is related to "Race Condition"-Problem regarding the "Options", though it shows up in different "flavours" (Exceptions):

Other issues (which seem related, but closed):
#1995
Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2#664
#1957
microsoftgraph/msgraph-sdk-java#977
#2456

We still see it in our APIs as mentioned here.
I have seen you guys pointing to .NET 7, but please note that we running on .NET 6
Also the proposed Workaround doesn't seem to be a good option, since in best case it would only hide the real problem.

Our setup in the app looks like this
var initialScopes = builder.Configuration["MicrosoftGraph:Scopes"]?.Split(' '); services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd")) .EnableTokenAcquisitionToCallDownstreamApi(initialScopes) .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph")) .AddDownstreamApi(ApiServiceName, builder.Configuration.GetSection("Api")).AddInMemoryTokenCaches();

Log:

2023-09-27T15:31:14.8689431+02:00 [ERR] (Microsoft.Identity.Web.TokenAcquisition) False MSAL 4.56.0.0 MSAL.NetCore .NET 6.0.14 Microsoft Windows 10.0.17763 [2023-09-27 13:31:14Z - 3bd1f709-ca5d-4119-96b9-57ce20f5ba97] === Token Acquisition (1000) failed.
	Host: login.microsoftonline.com.
2023-09-27T15:31:14.8690196+02:00 [ERR] (Microsoft.Identity.Web.TokenAcquisition) False MSAL 4.56.0.0 MSAL.NetCore .NET 6.0.14 Microsoft Windows 10.0.17763 [2023-09-27 13:31:14Z - 3bd1f709-ca5d-4119-96b9-57ce20f5ba97] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: invalid_grant
HTTP StatusCode 400
CorrelationId 3bd1f709-ca5d-4119-96b9-57ce20f5ba97

2023-09-27T15:31:14.8701773+02:00 [ERR] (Microsoft.Identity.Web.TokenAcquisition) False MSAL 4.56.0.0 MSAL.NetCore .NET 6.0.14 Microsoft Windows 10.0.17763 [2023-09-27 13:31:14Z - 3bd1f709-ca5d-4119-96b9-57ce20f5ba97] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: invalid_grant
HTTP StatusCode 400
CorrelationId 3bd1f709-ca5d-4119-96b9-57ce20f5ba97

   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
2023-09-27T15:31:14.8705754+02:00 [ERR] (Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler) Exception occurred while processing message.
MSAL.NetCore.4.56.0.0.MsalUiRequiredException: 
	ErrorCode: invalid_grant
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.
Trace ID: 7dff5831-4397-4c81-bd67-fdfc8bba1000
Correlation ID: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97
Timestamp: 2023-09-27 13:31:14Z
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByAuthorizationCodeParameters authorizationCodeParameters, CancellationToken cancellationToken)
   at Microsoft.Identity.Web.TokenAcquisition.AddAccountToCacheFromAuthorizationCodeAsync(AuthCodeRedemptionParameters authCodeRedemptionParameters)
   at Microsoft.Identity.Web.TokenAcquisitionAspNetCore.AddAccountToCacheFromAuthorizationCodeAsync(AuthorizationCodeReceivedContext context, IEnumerable`1 scopes, String authenticationScheme)
   at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<<WebAppCallsWebApiImplementation>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<<WebAppCallsWebApiImplementation>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunAuthorizationCodeReceivedEventAsync(OpenIdConnectMessage authorizationResponse, ClaimsPrincipal user, AuthenticationProperties properties, JwtSecurityToken jwt)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
	StatusCode: 400 
	ResponseBody: {"error":"invalid_grant","error_description":"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.\r\nTrace ID: 7dff5831-4397-4c81-bd67-fdfc8bba1000\r\nCorrelation ID: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97\r\nTimestamp: 2023-09-27 13:31:14Z","error_codes":[54005],"timestamp":"2023-09-27 13:31:14Z","trace_id":"7dff5831-4397-4c81-bd67-fdfc8bba1000","correlation_id":"3bd1f709-ca5d-4119-96b9-57ce20f5ba97"} 
	Headers: Cache-Control: no-store, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97
x-ms-request-id: 7dff5831-4397-4c81-bd67-fdfc8bba1000
x-ms-ests-server: 2.1.16424.6 - WEULR1 ProdSlices
x-ms-clitelem: 1,54005,0,,
X-XSS-Protection: 0
Set-Cookie: fpc=ApnMXQjg__FAkm4RgxMIOt4SbphfDAAAAG4lptwOAAAAbZKiARQAAACWJabcDgAAAA; expires=Fri, 27-Oct-2023 13:31:14 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly
Date: Wed, 27 Sep 2023 13:31:13 GMT

2023-09-27T15:31:14.8712050+02:00 [ERR] (Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware) An unhandled exception has occurred while executing the request.
System.Exception: An error was encountered while handling the remote login.
 ---> MSAL.NetCore.4.56.0.0.MsalUiRequiredException: 
	ErrorCode: invalid_grant
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.
Trace ID: 7dff5831-4397-4c81-bd67-fdfc8bba1000
Correlation ID: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97
Timestamp: 2023-09-27 13:31:14Z
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByAuthorizationCodeParameters authorizationCodeParameters, CancellationToken cancellationToken)
   at Microsoft.Identity.Web.TokenAcquisition.AddAccountToCacheFromAuthorizationCodeAsync(AuthCodeRedemptionParameters authCodeRedemptionParameters)
   at Microsoft.Identity.Web.TokenAcquisitionAspNetCore.AddAccountToCacheFromAuthorizationCodeAsync(AuthorizationCodeReceivedContext context, IEnumerable`1 scopes, String authenticationScheme)
   at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<<WebAppCallsWebApiImplementation>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<<WebAppCallsWebApiImplementation>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunAuthorizationCodeReceivedEventAsync(OpenIdConnectMessage authorizationResponse, ClaimsPrincipal user, AuthenticationProperties properties, JwtSecurityToken jwt)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
	StatusCode: 400 
	ResponseBody: {"error":"invalid_grant","error_description":"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.\r\nTrace ID: 7dff5831-4397-4c81-bd67-fdfc8bba1000\r\nCorrelation ID: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97\r\nTimestamp: 2023-09-27 13:31:14Z","error_codes":[54005],"timestamp":"2023-09-27 13:31:14Z","trace_id":"7dff5831-4397-4c81-bd67-fdfc8bba1000","correlation_id":"3bd1f709-ca5d-4119-96b9-57ce20f5ba97"} 
	Headers: Cache-Control: no-store, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 3bd1f709-ca5d-4119-96b9-57ce20f5ba97
x-ms-request-id: 7dff5831-4397-4c81-bd67-fdfc8bba1000
x-ms-ests-server: 2.1.16424.6 - WEULR1 ProdSlices
x-ms-clitelem: 1,54005,0,,
X-XSS-Protection: 0
Set-Cookie: fpc=ApnMXQjg__FAkm4RgxMIOt4SbphfDAAAAG4lptwOAAAAbZKiARQAAACWJabcDgAAAA; expires=Fri, 27-Oct-2023 13:31:14 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly
Date: Wed, 27 Sep 2023 13:31:13 GMT

   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

[jrmcdona]

Also having this issue on .NET 6 and Microsoft.Identity.Web 2.14.0

		```

//configure OIDC providers
ConfigureOpenIdConnectOptions(services, configuration, OpenIdConnectDefaults.AuthenticationScheme);

		// configure OIDC authentication with cookie persistence
		services
			.AddAuthentication(options =>
			{
				options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
				options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
			})
			.AddMicrosoftIdentityWebApp(
				microsoftIdentityOptions => {
					configuration2.Bind("AAD", microsoftIdentityOptions);
					microsoftIdentityOptions.ClientCertificates = new CertificateDescription[] {
						CertificateDescription.FromKeyVault("",
									 "")  //https://github.com/AzureAD/microsoft-identity-web/wiki/Certificates#specifying-certificates
					};
			})
			.EnableTokenAcquisitionToCallDownstreamApi(new string[] { "" })  //Scope for the Shell Header service
			 .AddDownstreamApi("SuiteShellAPI", configuration2.GetSection("SuiteShellService"))
				 .AddInMemoryTokenCaches();

[jmprieur]

@jrmcdona : I believe that your issue will be fixed by this PR: #2489
Are you able to test? (building from the repo)?

[TejendraPrasad]

@jmprieur thank you for fixing this.

I have updated package version to 2.15.1 and deployed it.

Will keep and eye and update you regarding this any error logs occur.

[AndreErb]

@TejendraPrasad @jmprieur
We gave V2.15.2 a try today and still got the same error.

However, we are not using the "AddMicrosoftIdentityWebApp" extension method with "microsoftIdentityOptions " like @jrmcdona does. So the new version could not help us, right?!?

We use

var initialScopes = builder.Configuration["MicrosoftGraph:Scopes"]?.Split(' ');
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
	.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
	.EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
	.AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
	.AddDownstreamApi(licenseService, builder.Configuration.GetSection("xxxApi"))
	.AddInMemoryTokenCaches();

[TejendraPrasad]

@AndreErb, thank you! i am yet not sure it has solved.. just today updated nuget package and deployed in Live... so will monitor the changes...

Note When implementing the Microsoft.Identity.Web as the OIDC client, designed explicitly for Azure AD and Azure B2C, it is vital to include the necessary configuration within the MicrosoftIdentityOptions. Failing to do so may result in the not working of downstream APIs. Conversely, if OpenID Connect is used directly, with a distinct Identity Provider (IDP), it is essential to incorporate the OpenIdConnectOptions configuration. These configurations should be integrated into the services of the ASP.NET Core application for seamless functionality.

@jmprieur - can only correct my understanding...

I use OpenIdConnectOptions and CookieAuthenticationOptions options not MicrosoftIdentityOptions...

Yes, i use below for SignIn

services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
.EnableTokenAcquisitionToCallDownstreamApi()
.AddInMemoryTokenCaches();

And, I access .NET Custom API on behalf of App

return await _tokenAcquisition.GetAccessTokenForAppAsync(scope);

And, for Graph i use SDK

Microsoft.Graph

var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);

_graphServiceClient = new GraphServiceClient(clientSecretCredential, scopes);

[AndreErb]

When implementing the Microsoft.Identity.Web as the OIDC client, designed explicitly for Azure AD and Azure B2C, it is vital to include the necessary configuration within the MicrosoftIdentityOptions. Failing to do so may result in the not working of downstream APIs. Conversely, if OpenID Connect is used directly, with a distinct Identity Provider (IDP), it is essential to incorporate the OpenIdConnectOptions configuration

@TejendraPrasad
What exactly are you referring to, in regards to the MicrosoftIdentityOptions? Usually we do not use these options at all and didn't have an issue with our Downstream APIs.

[TejendraPrasad]

@AndreErb, I apologise for any misunderstanding, Please ignore my comments.. :-)

For me the latest version hasn't yet created any problems, but I'll wait a few more days.

[TejendraPrasad]

@jmprieur

I am getting same error "AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token." after updating Version to 2.15.2.0.. It was fine for 1 month....

09:53:35] [Error] [Microsoft.Identity.Web.TokenAcquisition] False MSAL 4.56.0.0 MSAL.NetCore .NET 6.0.15 Microsoft Windows 10.0.17763 [2023-11-17 09:53:35Z - 77da2591-ddf7-40c0-adf6-c6ccf4c43238] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: invalid_grant
HTTP StatusCode 400
CorrelationId 77da2591-ddf7-40c0-adf6-c6ccf4c43238

at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
[09:53:35] [Error] [Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler] Exception occurred while processing message.
MSAL.NetCore.4.56.0.0.MsalUiRequiredException:
ErrorCode: invalid_grant
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600 Correlation ID: 77da2591-ddf7-40c0-adf6-c6ccf4c43238 Timestamp: 2023-11-17 09:53:36Z
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByAuthorizationCodeParameters authorizationCodeParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Web.TokenAcquisition.AddAccountToCacheFromAuthorizationCodeAsync(AuthCodeRedemptionParameters authCodeRedemptionParameters)
at Microsoft.Identity.Web.TokenAcquisitionAspNetCore.AddAccountToCacheFromAuthorizationCodeAsync(AuthorizationCodeReceivedContext context, IEnumerable`1 scopes, String authenticationScheme)
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunAuthorizationCodeReceivedEventAsync(OpenIdConnectMessage authorizationResponse, ClaimsPrincipal user, AuthenticationProperties properties, JwtSecurityToken jwt)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
StatusCode: 400
ResponseBody: {"error":"invalid_grant","error_description":"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600 Correlation ID: 77da2591-ddf7-40c0-adf6-c6ccf4c43238 Timestamp: 2023-11-17 09:53:36Z","error_codes":[54005],"timestamp":"2023-11-17 09:53:36Z","trace_id":"ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600","correlation_id":"77da2591-ddf7-40c0-adf6-c6ccf4c43238"}
Headers: Cache-Control: no-store, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 77da2591-ddf7-40c0-adf6-c6ccf4c43238
x-ms-request-id: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600
x-ms-ests-server: 2.1.16729.8 - NEULR1 ProdSlices
x-ms-clitelem: 1,54005,0,,
X-XSS-Protection: 0
Set-Cookie: fpc=Au0zPikUqa5MqZfs_iUWQWrcAm_7AgAAAB4v6dwOAAAA; expires=Sun, 17-Dec-2023 09:53:36 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly
Date: Fri, 17 Nov 2023 09:53:35 GMT

[09:53:35] [Error] [] OnAuthenticationFailed AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600 Correlation ID: 77da2591-ddf7-40c0-adf6-c6ccf4c43238 Timestamp: 2023-11-17 09:53:36Z
MSAL.NetCore.4.56.0.0.MsalUiRequiredException:
ErrorCode: invalid_grant
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600 Correlation ID: 77da2591-ddf7-40c0-adf6-c6ccf4c43238 Timestamp: 2023-11-17 09:53:36Z
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary2 additionalBodyParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByAuthorizationCodeParameters authorizationCodeParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Web.TokenAcquisition.AddAccountToCacheFromAuthorizationCodeAsync(AuthCodeRedemptionParameters authCodeRedemptionParameters)
at Microsoft.Identity.Web.TokenAcquisitionAspNetCore.AddAccountToCacheFromAuthorizationCodeAsync(AuthorizationCodeReceivedContext context, IEnumerable`1 scopes, String authenticationScheme)
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Web.MicrosoftIdentityWebAppAuthenticationBuilder.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunAuthorizationCodeReceivedEventAsync(OpenIdConnectMessage authorizationResponse, ClaimsPrincipal user, AuthenticationProperties properties, JwtSecurityToken jwt)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
StatusCode: 400
ResponseBody: {"error":"invalid_grant","error_description":"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600 Correlation ID: 77da2591-ddf7-40c0-adf6-c6ccf4c43238 Timestamp: 2023-11-17 09:53:36Z","error_codes":[54005],"timestamp":"2023-11-17 09:53:36Z","trace_id":"ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600","correlation_id":"77da2591-ddf7-40c0-adf6-c6ccf4c43238"}
Headers: Cache-Control: no-store, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 77da2591-ddf7-40c0-adf6-c6ccf4c43238
x-ms-request-id: ecd07edb-bb52-4b2b-8c15-ee2f7f4e2600
x-ms-ests-server: 2.1.16729.8 - NEULR1 ProdSlices
x-ms-clitelem: 1,54005,0,,
X-XSS-Protection: 0
Set-Cookie: fpc=Au0zPikUqa5MqZfs_iUWQWrcAm_7AgAAAB4v6dwOAAAA; expires=Sun, 17-Dec-2023 09:53:36 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly
Date: Fri, 17 Nov 2023 09:53:35 GMT

[ahiraiwa]

@jmprieur
We are also encountering the same error.
Our version of Microsoft.Identity.Web is 2.15.2.

We are developing a SPA with Razor Pages and using Microsoft.Identity.Web for Azure AD authentication in this SPA.

We have been collecting Trace logs and Exception logs when AADSTS54005 occurs, and here are a part of those logs.

The error AADSTS54005 occurs after accessing https://login.microsoftonline.com:443/{Application_ID}/oauth2/v2.0/token from the internal process of /signin-oidc during the sign-in process.

For more details, please see the attached image file 'EndToEndTransactionDetails.png'.

As shown in the timeline of the image file, there are two accesses to /oauth2/v2.0/token within /signin-oidc, and the response code of the second access is Bad Request (400).

It seems that AADSTS54005 is occurring because a new token could not be obtained due to the second access to /oauth2/v2.0/token returning a response code of 400, and the token obtained from the first access to /oauth2/v2.0/token is reused.

For more details, please see the attached file 'logs.csv'.

logs.csv

Up to line 35 is the log of the first successful call to /oauth2/v2.0/token.
From line 36 onwards is the log of the second call to /oauth2/v2.0/token that returned a Bad Request.

What kind of request would cause a Bad Request (400) to /oauth2/v2.0/token is a matter of great interest, but in our environment, capturing the access from /sigin-oidc to /oauth2/v2.0/token is not allowed, so we cannot know.

However, in situations where AADSTS54005 occurs, /signin-oidc also returns a Bad Request (400), and we have captured the request from the web browser to /signin-oidc at that time.

The attached file 'BadRequestLog.txt' is the captured request when /signin-oidc returned a Bad Request (400).
(Just to note, the timing of the logs in 'logs.csv' and the occurrence of 'BadRequestLog.txt' are different.)

BadRequestLog.txt

As you can see from the file, there are lots of .AspNetCore.OpenIdConnect.Nonce. and .AspNetCore.Correlation. in the value of the Cookie header.

At the time of occurrence of AADSTS54005, it is confirmed that the request header to /signin-oidc is similar to the request header in 'BadRequestLog.txt'.

In IIS, it is known that a response of Bad Request (400) happens when the size of the request header exceeds the limit.

In fact, in our environment, it seems that the request header is limited to about 16KB, but the size of the request header saved in 'BadRequestLog.txt' exceeds 16KB.

Therefore, it is presumed that when accessing /oauth2/v2.0/token from /signin-oidc results in a Bad Request (400), the request's Cookie header also contains numerous .AspNetCore.OpenIdConnect.Nonce. and .AspNetCore.Correlation..

If you have any other information that might help solve the problem, please let us know.
We will share as much as we can.