OIDC Client Logging

OidcClient logs errors, warnings, and diagnostic information using Microsoft.Extensions.Logging.ILogger, the standard .NET logging library.

For log level definitions, environment guidance, and actionable next steps for each level, see the Logging Fundamentals guide.

Logging FundamentalsLog level definitions, environment configuration table, and the log level anxiety spectrum.

Configuration

Wiring Up a Logger Factory

OidcClient does not use the ASP.NET Core dependency injection container directly — instead, you configure it by setting the LoggerFactory property on OidcClientOptions. This gives you full control over logging in native app, mobile, and console scenarios.

Program.cs

using Duende.IdentityModel;
using Duende.IdentityModel.OidcClient;

var builder = Host.CreateApplicationBuilder(args);

builder.Services.AddSingleton(svc =>
{
    var loggerFactory = svc.GetRequiredService<ILoggerFactory>();
    var options = new OidcClientOptions
    {
        Authority = "https://demo.duendesoftware.com",
        ClientId = "interactive.public",
        Scope = "openid profile email offline_access",
        RedirectUri = "app://localhost/",
        PostLogoutRedirectUri = "app://localhost/",
        LoggerFactory = loggerFactory
    };
    return new OidcClient(options);
});

var app = builder.Build();
var client = app.Services.GetService<OidcClient>();

You can use any logging framework that integrates with ILoggerFactory, such as Serilog.

Log Level Configuration

OidcClient emits logs at Trace, Debug, Information, and Error levels. To control log output, set the Duende.IdentityModel.OidcClient namespace in your appsettings.json:

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information",
      "Duende.IdentityModel.OidcClient": "Error"
    }
  }
}

What Gets Logged

OidcClient emits structured log messages across several functional areas. Each message includes contextual parameters for effective filtering and troubleshooting.

Login Flow

Level	Message	Description
Trace	LoginAsync	Beginning the login method
Information	Starting authentication request.	Login flow initiated
Information	Authentication request success.	Login completed successfully
Trace	PrepareLoginAsync	Preparing login state for manual flow
Trace	CreateAuthorizeStateAsync	Creating PKCE and state parameters
Debug	The IdentityProvider contains a pushed authorization request endpoint. Automatically pushing authorization parameters. Use DisablePushedAuthorization to opt out.	PAR endpoint detected and being used
Error	Failed to push authorization parameters	PAR request failed
Trace	CreateAuthorizeUrl	Building the authorization URL
Trace	CreateAuthorizeParameters	Assembling authorize request parameters
Trace	AuthorizeAsync	Starting browser-based authorization

Response Processing

Level	Message	Description
Trace	ProcessResponseAsync	Beginning response processing
Information	Processing response.	Handling authorization response
Debug	Authorize response: {Response}	Raw authorization response data
Trace	ProcessCodeFlowResponseAsync	Processing authorization code flow
Trace	RedeemCodeAsync	Exchanging code for tokens
Trace	ValidateTokenResponse	Validating token endpoint response
Error	{Error}	Authorization or token response error

Discovery Document

Level	Message	Description
Trace	EnsureProviderInformation	Checking provider configuration
Debug	Skipping refresh of discovery document.	Reusing cached discovery document
Debug	Successfully loaded discovery document	Discovery document retrieved
Debug	Loaded keyset from {JwksUri}	JSON Web Key Set location
Debug	Keyset contains the following kids: {Kids}	Available signing key IDs
Error	Error loading discovery document: {ErrorType} - {Error}	Discovery document retrieval failed
Error	Issuer name is missing in provider information	Invalid provider configuration
Error	Authorize endpoint is missing in provider information	Invalid provider configuration
Error	Token endpoint is missing in provider information	Invalid provider configuration
Error	Key set is missing in provider information	Invalid provider configuration (when required)

UserInfo

Level	Message	Description
Trace	GetUserInfoAsync	Starting userinfo request
Error	Error contacting userinfo endpoint: {Error}	Userinfo request failed
Error	sub claim is missing from userinfo endpoint	Userinfo response missing required claim
Error	sub claim from userinfo endpoint is different than sub claim from identity token.	Subject mismatch between tokens

Token Refresh

Level	Message	Description
Trace	RefreshTokenAsync	Starting token refresh
Error	Failed on RefreshTokensAsync: {Error} - {Description}	Automatic token refresh failed (RefreshTokenDelegatingHandler)

Logout

Level	Message	Description
Trace	CreateEndSessionUrl	Building the end session URL

Claims Processing

Level	Message	Description
Trace	ProcessClaims	Merging claims from tokens and userinfo
Debug	Claim: {Type}: {Value}	Individual claim being processed

Configuration

Level	Message	Description
Trace	Effective options:	Followed by serialized OidcClientOptions

Sensitive Data

At Trace level, the full OidcClientOptions configuration is serialized to logs, which can help diagnose configuration issues. Be cautious with Trace logging in production as it may expose sensitive configuration details.