AuthenticateWithPasswordAsync throws null ref exception

[philmiatech]

Describe the bug?

When logging in using username & password through the idx client twice in succession, the first attempt succeeds but the second attempt fails with a null ref error.

On the second attempt, the error comes from IdxClient.cs AuthenticateWithPasswordAsync when attempting to access a null remediation object within the IdxResponse (result of IntrospectAsync(...)).

https://github.com/okta/okta-idx-dotnet/blob/Okta.Idx.Sdk%40v2.2.7/src/Okta.Idx.Sdk/IdxClient.cs#L584

Our client is setup like so:

        _idxClient = new IdxClient(
            new Okta.Idx.Sdk.Configuration.IdxConfiguration()
            {
                Issuer = "https://<removed>/oauth2/default",
                ClientId = "<removed>",
                ClientSecret = "<removed>",
                Scopes = new List<string> { "openid", "profile", "offline_access" },
                RedirectUri = "http://<removed>/login/callback", 
            }
        );

And the client's AuthenticateAsync method is called with this snippet:

            var authnOptions = new AuthenticationOptions
            {
                Username = username,
                Password = password,
            };

            var authnResponse = await _idxClient.AuthenticateAsync(authenticationOptions: authnOptions).ConfigureAwait(false);

            if (authnResponse.AuthenticationStatus == Okta.Idx.Sdk.AuthenticationStatus.Success)
            {
                var accessToken = authnResponse.TokenInfo.AccessToken;
            }

What is expected to happen?

Auth works every time.

What is the actual behavior?

"Object reference not set to an instance of an object." error is returned from the AuthenticateWithPasswordAsync method.

Reproduction Steps?

Call login endpoint which uses the idx client (SUCCESS), call endpoint again (FAILURE).

Additional Information?

No response

.NET Version

7.0.102

SDK Version

2.2.7

OS version

Happens using macOS and Windows dev environments.

[philmiatech]

Potentially resolving the issue by reinstantiating the client for each request, aka transient scope through DI. The sample project appears to setup the IdxClient similarly using the TransientLifetimeManager.

The Classic Engine Authentication SDK seems to be working as a singleton.

Might be worth updating the readme if this is expected use/behavior for the new Idx sdk.

[philmiatech]

https://github.com/okta/okta-idx-dotnet/blob/master/src/Okta.Idx.Sdk/IIdxResponse.cs#L39 Code documentation for the IIdxResponse class indicates that remediation may be null. So the code in the IdxClient ~line 584 may still fail under other circumstances.