Getting AADSTS1100001: Non-retryable error has occurred. after adding custom claims provider

Jadran Bižić 20

I have set up a tenant for testing various authentication methods by using my Visual Studio Enterprise Subscription. Users are synced from on premise AD and pass through authentication is used. I have set up test app and I could authenticate and get access token on the side of the app. Then, because of the project requirement, I tried to add custom claims provider. First I used my app and set up everything based on https://video2.skills-academy.com/en-us/entra/identity-platform/custom-extension-get-started?tabs=entra-admin-center%2Chttp and I got error: AADSTS1100001: Non-retryable error has occurred.

After various attempts to correct this I deleted everything and then did exactly what is described in tutorial from the link and I still got the same error.

Is there any way to find out what is causing this error or is there any way to resolve it or work around it?

Sandeep G-MSFT 16,201 Reputation points Microsoft Employee

2023-12-26T08:29:46.8133333+00:00

@Jadran Bižić

Thank you for posting this in Microsoft Q&A.

I wanted to check if you are trying to add custom claim provider in Azure and get claims out of it?
Jadran Bižić 20 Reputation points

2023-12-26T09:05:54.84+00:00

Hi Sandeep,

thank you for your reply.

Yes, I'm trying to get additional data into token via Azure function. It seemed to me that custom claims provider would be exactly right for that.
Sandeep G-MSFT 16,201 Reputation points Microsoft Employee

2024-01-03T08:41:19.69+00:00

@Jadran Bižić

This needs little deeper investigation. Let's work on this issue offline.

Please send us an email on azcommunity [at] microsoft [dot] com with Sub - Attn: Sandeg and following details in the email body:

Link to this thread/post

We can connect offline and discuss further on this.
Jadran Bižić 20 Reputation points

2024-01-03T10:10:16.1033333+00:00

Hi Sandeep,

I have tried to send email to azcommunity [at] microsoft [dot] com¸ but I got back error:

Delivery has failed to these recipients or groups:

mtmvp@microsoft.com
Your message wasn't delivered because the recipient's email provider rejected it.

Diagnostic information for administrators:

Generating server: CH2PR21MB1382.namprd21.prod.outlook.com

mtmvp@microsoft.com
Remote Server returned '554 5.7.0 < #5.7.133 smtp;550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group>'
Henrique Teles Ribeiro 20 Reputation points

2024-01-12T04:09:10.2333333+00:00

I'm having the same issue. I have an Microsoft Entra B2C Tenant and a Azure Function in another Microsoft Entra ID tenant. I followed this tutorial the way it's written without skipping any steps. Everything works correctly until step 5.1 (Using OpenID Connect identity provider) when trying to secure the Azure function. https://video2.skills-academy.com/en-us/entra/identity-platform/custom-extension-attribute-collection?context=%2Fentra%2Fexternal-id%2Fcustomers%2Fcontext%2Fcustomers-context&tabs=start-continue%2Csubmit-continue When I open a web app and try to sign-up with a new user, I receive this message:

Thie happens after I confirm the code received in e-mail.
Jason Peate 0 Reputation points

2024-03-04T09:28:42.1766667+00:00

Was this ever solved? As I have gotten to the same error
Jadran Bižić 20 Reputation points

2024-03-04T09:32:40.8933333+00:00

Unfortunately it didn't. We decided to use different Identity provider.

Regards,
Jadran Bižić.
Jadran Bižić 20 Reputation points

2024-03-04T09:35:04.7+00:00

Unfortunately it didn't. We decided to use different Identity provider.
Jason Peate 0 Reputation points

2024-03-06T14:28:49.75+00:00

Any more information on this?
Admin Amir Chisti 5 Reputation points

2024-06-11T12:57:59.7966667+00:00

We had the same issue and it seems the metadata URL in the official docs is wrong for the cross tenant using OpenID Connect identity provider. In docs it is https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration but it should be https://{domainName}.ciamlogin.com/{tenant_id}/v2.0/.well-known/openid-configuration
Nevalainen Jani 0 Reputation points

2024-07-02T13:25:10.7066667+00:00

I managed to fix the problem by following Admin Amir Chisti's advice using the URL: https://{domainName}.ciamlogin.com/{tenant_id}/v2.0/.well-known/openid-configuration in the Open ID Connect identity provider configuration.
Frank Goulart 0 Reputation points

2024-07-02T16:27:36.85+00:00

Complicated instructions to set up. I never got it to work with a WebJobsTokenIssuanceStartRequest. Instead, we switched to an HTTP Trigger function and had success. Claims entered into your custom auth extension are case sensitive so watch for that.

1 answer

Son Pham 0 Reputation points

2024-04-12T13:10:55.3466667+00:00

I have the same issue as well. It seems like when we add Authentication to protect Azure Function then we get this error. If we don't add it then it works properly.
Please sign in to rate this answer.
Son Pham 0 Reputation points

2024-04-15T15:57:34.1+00:00

I dont know if this bug has been reported or am I missing something in configurations.
Sign in to comment

Share via

Getting AADSTS1100001: Non-retryable error has occurred. after adding custom claims provider

1 answer