error loading discovery document - AD FS integration using angular-oauth2-oidc

Question

I am working on an angular SPA which is needed to be authenticated using AD FS. I am using Spring Boot as a backend.

this.oauthService.configure({
      redirectUri: window.location.origin + '/app/search',
      requireHttps: true,
      scope: 'openid profile email',
      responseType: 'id_token token',
      oidc: true,
      clientId: environment.adfsClientId,
      loginUrl: environment.adfsUrl + '/oauth2/authorize',
      issuer: environment.adfsUrl,
      logoutUrl:
        environment.adfsUrl +
        '/ls/?wa=wsignoutcleanup1.0&wreply=' +
        location.protocol +
        '//' +
        location.hostname +
        (location.port ? ':' + location.port : ''),
      postLogoutRedirectUri:
        location.protocol +
        '//' +
        location.hostname +
        (location.port ? ':' + location.port : ''),
    });

The above given is the configuration. And I am following this as a reference.

But I am getting the below error.

error loading discovery document O {headers: h, status: 0, statusText: "Unknown Error", url: "https://adfs_domain/adfs/.well-known/openid-configuration", ok: false, …} error: ProgressEvent {isTrusted: true, lengthComputable: false, loaded: 0, total: 0, type: "error", …} headers: h {normalizedNames: Map(0), lazyUpdate: null, headers: Map(0)} message: "Http failure response for https://adfs_domain/adfs/.well-known/openid-configuration: 0 Unknown Error" name: "HttpErrorResponse" ok: false status: 0 statusText: "Unknown Error" url: "https://adfs_domain/adfs/.well-known/openid-configuration"

Note: I can access the same URL, https://adfs_domain/adfs/.well-known/openid-configuration, from my browser. the issuer URL in the config and the response in the browser are the same too.

can anyone help?

Answer 1

That will be a CORS issue, where ADFS is not allowing a cross domain request to the discovery endpoint from your SPA's web origin.

• If the discovery endpoint works from the browser there are no problems with SSL certificates

• But accessing the discovery endpoint in the browser is not a cross domain request

See item 4 in this document. All Authorization Servers have options for enabling CORS for SPA clients though the option seems a little painful in ADFS.

Answer 2

This problem occurred to me because of my application's HTTP_INTERCEPTORS.

• try removing the interceptor and test again
• use the correct version to oidc for your application

This worked for me.