Issue with IdentityServer4 Provider!

[phamhungvn]

Question 💬

Dear all,
I'm running next-auth-example and facing a problem need your support. If I sign in with IdentityServer4, it always return

https://undefined/connect/authorize? response_type=code&scope=openid%20profile%20email&state=b15f7ba9989d1bf7442156d3b6b6f78f6ac4c5babd4a8ee1ecd9da4cade3ce91&redirect_uri=http%3A%2F%2Flocalhost%3A4001%2Fapi%2Fauth%2Fcallback%2Fdemo-identity-server&client_id=interactive.confidential

How to reproduce ☕️

1. In file pages/api/auth/[...nextauth].js, I added IdentityServer4 as a new provider as suggested at https://next-auth.js.org/providers/identity-server4:

Providers.IdentityServer4({
      id: "demo-identity-server",
      name: "Demo IdentityServer4",
      authorization: { params: { scope: "openid profile email api offline_access" } },
      issuer:  "https://demo.identityserver.io/",
      clientId: "interactive.confidential",
      clientSecret: "secret",
    })

2. Then I start the Application:

• Set port=4001 (The default port 3000 was being used by another app so I choose port 4001)
• npm run dev

3. I choose the option "Sign in with "Demo IdentityServer4" and it redirects to https://undefined/connect/authorize?response_type=code&scope=openid%20profile%20email&state=b15f7ba9989d1bf7442156d3b6b6f78f6ac4c5babd4a8ee1ecd9da4cade3ce91&redirect_uri=http%3A%2F%2Flocalhost%3A4001%2Fapi%2Fauth%2Fcallback%2Fdemo-identity-server&client_id=interactive.confidential

I got the same error if testing with my localhost IdentityServer.
I have tested other providers and it worked well (GitHub, Google)

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[phamhungvn]

I have found the root cause: IdentityServer4 need to have one more option: domain. So settings for IdentityServer4 provider should be updated as below:
Providers.IdentityServer4({
id: "demo-identity-server",
name: "Demo IdentityServer4",
authorization: { params: { scope: "openid profile email api offline_access" } },
issuer: "https://demo.identityserver.io/",
clientId: "interactive.confidential",
clientSecret: "secret",
domain: "demo.identityserver.io",
})

[balazsorban44]

I am curious which version you are using. To contact the demo IDS server, I only need the following config:

next-auth/app/pages/api/auth/[...nextauth].ts

Lines 131 to 135 in 38cefdd

	IDS4Provider({
	clientId: process.env.IDS4_ID,
	clientSecret: process.env.IDS4_SECRET,
	issuer: process.env.IDS4_ISSUER,
	}),

IDS4_ID = "interactive.confidential"
IDS4_SECRET = "secret"
IDS4_ISSUER = "https://demo.identityserver.io"

Try upgrading to the latest beta by running npm install next-auth@beta

[phamhungvn]

Oh I see: You're providing v3 syntax in the file https://github.com/nextauthjs/next-auth-example/blob/main/pages/api/auth/%5B...nextauth%5D.js but I used syntax v4 for ID4.
Many thanks!
By the way, I'm new to Next-Auth JS (and new to NextJS too). My I ask you how to get full payload data for JWT? Currently, JWT's payload data only contain following information:
{
"name": "admin",
"email": "[email protected]",
"picture": null,
"sub": "1",
"iat": 1636878972,
"exp": 1639470972
}.
Can I get full payload data like below:
{
"nbf": 1636876169,
"exp": 1668412169,
"iss": "https://localhost:44318",
"aud": "OrganisationManagement",
"client_id": "OrganisationManagement",
"sub": "365195e9-0c31-9b79-2a51-39ff8cb973be",
"auth_time": 1636876169,
"idp": "local",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "admin",
"preferred_username": "admin",
"given_name": "admin",
"role": "admin",
"phone_number_verified": "False",
"email": "[email protected]",
"email_verified": "False",
"name": "admin",
"sid": "522E110145AE8A207F7BC0376853FCE2",
"iat": 1636876169,
"scope": [
"OrganisationManagement"
],
"amr": [
"pwd"
]
}

[balazsorban44]

Absolutely: https://next-auth.js.org/getting-started/example#extensibility

[phamhungvn]

Can I ask you one more question:
I want to implement Federated Signout: When a user sign-out from a NextJS Application, IdentityServer will remove the authentication cookie and also need to notify other clients that the user has signed out (Assume that this user already signed in on several browsers)
I think a possible solution is: The clients must perform monitoring on the check_session_iframe (Ex: https://demo.identityserver.io/connect/checksession).
May I know if NextAuthJS already provided an api for this?
Many thanks!

[balazsorban44]

Not currently, but I've implemented this at work. You can find the steps here: #836

Also this would be a nice addition to NextAuth.js in the future, I agree.

[phamhungvn]

Hi!
I need your help:
I have checkout the latest source code from https://github.com/nextauthjs/next-auth-example/tree/ndom91/update-v4
and run but it encounter an error:
Unhandled Runtime Error
TypeError: getCurves is not a function
Please give me advices!
Many thanks!