Error loading discovery document with Okta SSO in .NET Framework desktop app

[NandhiniM11]

I’m integrating Okta SSO into an existing .NET Framework 4.8 desktop application. I’m using Duende.IdentityModel.OidcClient v6.0.1.

I’ve set up OidcClientOptions with the following parameters:

Authority
ClientId
Scope
RedirectUri
Browser (system browser)
LoadProfile = true

When I try to open the browser for SSO, I get the following error:
Error loading discovery document: Invalid base address for endpoint https://trial-4119525.okta.com/oauth2/v1/clients. Valid base addresses: https://trial-4119525.okta.com/oauth2/default.

Can someone please guide me on how to resolve this? I want to use a native desktop application with Okta SSO without client secret.

[wcabus]

Which URL are you using for the Authority property?
If you set the authority property to https://trial-4119525.okta.com, the OIDC client will try to locate the discovery document at https://trial-4119525.okta.com/.well-known/openid-configuration which seems to be the correct one.

[wcabus]

Duende.IdentityModel.OidcClient doesn't support dynamic client registration out of the box, so perhaps that's why it's missing the registration endpoint details. Can you share a bit more on how you're trying to achieve this?

[NandhiniM18]

Below is the code snippet in which i'm getting the earlier mentioned error:

string _oktaDomain = "trial-4119525.okta.com";
string _clientId = "0oawiga608PG3vX9I697"; 
string redirectUri = "http://localhost:7890/callback"; 
string[] scopes = new[] { "openid", "profile", "email" };

var options = new OidcClientOptions
{
    Authority = $"https://trial-4119525.okta.com/oauth2/default",
    ClientId = _clientId,
    RedirectUri = redirectUri,
    Scope = "openid profile email",
    Browser = new SystemBrowser(7890)
};

var client = new OidcClient(options);
try
{
    var result = await client.LoginAsync(new LoginRequest());
}
catch (Exception ex)
{
    throw;
}

[wcabus]

Can you try the following instead, based on your code snippet?

string _oktaDomain = "trial-4119525.okta.com";
string _clientId = "0oawiga608PG3vX9I697"; 
string redirectUri = "http://localhost:7890/callback"; 
string[] scopes = new[] { "openid", "profile", "email" };

var options = new OidcClientOptions
{
    Authority = $"https://trial-4119525.okta.com", // Authority should not have /oauth2/default at the end
    ClientId = _clientId,
    RedirectUri = redirectUri,
    Scope = "openid profile email",
    Browser = new SystemBrowser(7890)
};

var client = new OidcClient(options);
try
{
    var result = await client.LoginAsync(new LoginRequest());
}
catch (Exception ex)
{
    throw;
}

[NandhiniM18]

Thanks for the suggestion. This code change has cleared "Invalid base address" error which I originally reported. But now with the new code change, it errors out stating "Unauthorized - Failed to push authorization parameters"

[wcabus]

Hmm, that error may indicate that the client you've configured at Okta expects the client secret to be set. I would double check in Okta how you've configured the client (which grant type, etc.), and configure the native client's code accordingly.