title: Multiple IdentityServer Federation : Error Unable to unprotect the message.State
body: <p>I'm trying to create a master slave type configuration for authentication with IdentityServer4 as below</p>
  
  <pre><code>MyMasterIdentityServer0 (Master) - receives id_token and gives access_token
  |---&gt; MySlaveIdentityServer1 (Basic Auth)
  |---&gt; MySlaveIdentityServer2 (Windows Auth)
  |---&gt; MySlaveIdentityServer3 (SmartCard Certificate Auth)
  |---&gt; MySlaveIdentityServer4 (SAML SSO Auth)
  |---&gt; Cloud Demo IdentityServer
  |---&gt; Google Auth
  |---&gt; Facebook Auth
  |---&gt; Microsoft Auth
  |---&gt; Twitter Auth
  </code></pre>
  
  <p>All my applications and api will point to and authenticate with the <strong>MyMasterIdentityServer0</strong></p>
  
  <p>Users can have a choice of authentication using any of the above providers. They can choose username/password in which case they should be redirected to the <strong>MySlaveIdentityServer1 (Basic Auth)</strong>, or they can choose using the Windows Auth using their AD account in which case they will be redirected to <strong>MySlaveIdentityServer2 (Windows Auth)</strong>, or choose any other provider.</p>
  
  <p>Once the user has been authenticated, he receives an id_token from the provider server and gets redirected back to the <strong>MyMasterIdentityServer0</strong> where the external user is looked up using the Provider and ProviderUserId and then given an access_token to access the applications/api based on his permissions.</p>
  
  <p>They problem I'm facing is that the IdentityServer Master Slave configuration is not working for me and is giving me an error <strong>Unable to unprotect the message.State</strong> when the user is redirected back to the master server after authentication. I tried looking up the issue and AuthO also faced this same bug which they recently fixed.</p>
  
  <p><strong>Error Received</strong></p>
  
  <blockquote>
    <p>Exception: Unable to unprotect the message.State</p>
  </blockquote>
  
  <p><strong>IdentityServer-Master Configuration</strong></p>
  
  <pre><code>// WORKING
  app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
  {
      AuthenticationScheme = "ID4DemoCloud",
      DisplayName = "Login with ID4DemoCloud",
      SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
      SignOutScheme = IdentityServerConstants.SignoutScheme,
      Authority = "https://demo.identityserver.io/",
      ClientId = "implicit",
  
      TokenValidationParameters = new TokenValidationParameters
      {
          NameClaimType = "name",
          RoleClaimType = "role"
      },
      //Events = new OpenIdConnectEvents() { }
  });
  
  // NOT WORKING
  app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
  {
      AuthenticationScheme = "MySlaveIdentityServer1BasicAuth",
      DisplayName = "Login with MySlaveIdentityServer1 Basic Auth",
      SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
      SignOutScheme = IdentityServerConstants.SignoutScheme,
      Authority = "http://localhost:5100/",
      ClientId = "MyMasterIdentityServer0",
      ClientSecret = "secret",
      RequireHttpsMetadata = false,
  
      //TokenValidationParameters = new TokenValidationParameters
      //{
      //    NameClaimType = "name",
      //    RoleClaimType = "role"
      //},
  });
  </code></pre>
  
  <p><strong>Basic Auth Server Client Configuration</strong></p>
  
  <pre><code>public static class Clients
  {
      public static IEnumerable&lt;Client&gt; GetClients()
      {
          return new[]
          {
              new Client
              {
                  ClientId = "MyMasterIdentityServer0",
                  ClientName = "My Master IdentityServer 0",
                  ClientSecrets = new List&lt;Secret&gt; { new Secret("secret".Sha256()) },
                  AllowedGrantTypes = GrantTypes.Implicit,
                  AllowedScopes = new List&lt;string&gt;
                  {
                      StandardScopes.OpenId,
                      StandardScopes.Profile
                  },
                  RequireConsent = false,
                  AllowOfflineAccess = false,
                  RedirectUris = new [] { "http://localhost:5000/signin-oidc" }
              }
          };
      }
  }
  </code></pre>
  
  <p>All the auth providers are working fine except the internally deployed MySlaveIdentityServers 1, 2, 3 and 4 ... even the Cloud Demo Identity server is working fine. Can anyone give me any advice or suggestions ?</p>