Our MVC Core 2.0 application utilizes OPEN ID with OKTA for user authentication. When using the OKTA dashboard, OKTA sends the user to the web application which generates the following error.
Request starting HTTP/1.1 GET http://{Web Site.com}/authorization-code/callback ?iss=https%3A%2F%2F{x.Okta.com}
The request path /authorization-code/callback does not match a supported file type
.AspNetCore.Correlation. state property not found.
Error from RemoteAuthentication: Correlation failed…
Note that users do not have to navigate to our application from the OKTA dashboard, but can successfully sign in using a “Sign in using OKTA” button on the login screen. This follows a similar process: OKTA redirects the user to the callback but with a POST request and a slightly different URL, and there is no “iis” query parameter.
The user successfully logs in.
Request starting HTTP/1.1 POST http://{Web site.com}/authorization-code/callback application/x-www-form-urlencoded 443
connect.OpenIdConnectHandler|Updating configuration
connect.OpenIdConnectHandler|Redeeming code for tokens.
cookieAuthenticationHandler|AuthenticationScheme: Identity.External signed in.
connection id “…” completed keep alive response.
This is using the same (only 1) application in OKTA. Same application info, same keys, same URLs. This occurs in our stage environment, not dev or local.
Why does the OKTA dashboard redirect using a different HTTP method and different URLs.