What causes IIdentityServerInteractionService.GetAllUserGrantsAsync() to return empty result?

[gthvidsten]

I'm experimenting with setting up a 3rd party login (Microsoft) to IdentityServer. This works just fine and I can log on, I can get tokens, and I can see the correct transformed claims.

However, the IIdentityServerInteractionService.GetAllUserGrantsAsync() doesn't return anything!
The client is set up to not require consents (RequireConsent = 0 in the database).

The worst part is that this was working at some point and I don't know what I've done to make it stop working!
When I go back through my changes in my head I believe it stopped working when I added .AddServerSideSessions() but removing this doesn't make it work again. And I can't think of anything else I've done since it worked.

So what have I done to make .GetAllUserGrantsAsync() to stop working?

Here's my abbreviated code for the Microsoft callback URI which does the local sign in:

var result = await HttpContext.AuthenticateAsync(IdentityServerConstants.ExternalCookieAuthenticationScheme);
var externalUser = result.Principal;

string userId = externalUser.FindFirst("sub")?.Value;
string name = externalUser.FindFirst("name")?.Value;
string upn = externalUser.FindFirst("upn")?.Value;

var isUser = new IdentityServerUser(userId)
{
    DisplayName = name
};

await events.RaiseAsync(new UserLoginSuccessEvent(upn, userId, name));

await HttpContext.SignInAsync(isUser.CreatePrincipal());

await HttpContext.SignOutAsync(IdentityServerConstants.ExternalCookieAuthenticationScheme);

[khalidabuhakmeh]

@gthvidsten you mentioned a database. That's a good place to start to see if the information for your session matches what is stored in the database.

Here's the implementation of the GetAllUserGrantsAsync method you mentioned.

public async Task<IEnumerable<Grant>> GetAllUserGrantsAsync()
{
    using var activity = Tracing.ServiceActivitySource.StartActivity("DefaultIdentityServerInteractionService.GetAllUserGrants");

    var user = await _userSession.GetUserAsync();
    if (user != null)
    {
        var subject = user.GetSubjectId();
        return await _grants.GetAllGrantsAsync(subject);
    }

    return Enumerable.Empty<Grant>();
}

There are a few possible issues that could cause the grants to return an empty collection.

1. The user session is unable to get the user
2. The subjectId doesn't match what's stored in the IPersistedGrantService

Setting a breakpoint and stepping through the code might help focus the search.

[gthvidsten]

@khalidabuhakmeh Thanks for the reply.

After debugging I can see that the user sessions is able to get the user. The user also has the correct SubjectId as returned from .GetSubjectId()
The _grants.GetAllGrantsAsync(subject) returns an empty list. The PersistedGrants table in the database is empty, so if it looks there then that would explain why no grants are returned. I don't remember seeing it having any data when it worked previously either, but my memory of this might not be 100% correct.
The question then becomes, why is PersistedGrants empty?

[gthvidsten]

At the moment I'm afraid I don't have any other database servers to test with :(

[khalidabuhakmeh]

Another thing that may cause this issue is limited resources on the host environment. You mentioned you don't have another database to test with. Would you mind if I asked what your current hosting situation is?

[gthvidsten]

My current hosting situation was on my Windows 11 PC with 32GB RAM and an AMD Ryzen 9 CPU, so there should be more than enough resources.

[khalidabuhakmeh]

@gthvidsten Are you able to run SQL Server in a Docker container? There is an SQL Server Linux container that I've used successfully. This would be temporary, just to see if the issue persists once changing database engines. https://learn.microsoft.com/en-us/sql/linux/quickstart-install-connect-docker?view=sql-server-ver16&tabs=cli&pivots=cs1-bash

[gthvidsten]

I plan on getting it to work with MySQL hopefully during the week. I'll keep you posted :)