NullReferenceException in `BaseAuthenticationMethodController.BuildViewModel` when logging in with **correct** credentials (idserverui template, 7.0.0 / net10.0)

[innotway]

Description

Using the idserverui template freshly generated from SimpleIdServer.Templates 7.0.0 (targeting net10.0, the latest version currently on NuGet), submitting the login form with the default, correct credentials (administrator / password) throws an unhandled NullReferenceException server-side instead of completing the login.

This reproduces on a completely unmodified, freshly-generated project (no custom code beyond the default template output), so it does not appear to be specific to any particular hosting/configuration change.

I found #814, which reports a similar-looking NullReferenceException in the same controller, but that report is specifically about wrong password submissions. This report is about the login failing even with the correct password, which doesn't appear to be covered by #814.

Environment

• SimpleIdServer.Templates: 7.0.0 (also reproduces on 7.0.0-rc1; not tested on earlier 7.x since 7.0.0 is the first non-rc release)
• Generated packages: SimpleIdServer.IdServer / SimpleIdServer.IdServer.Pwd 7.0.*-* (resolved to 7.0.0)
• Target framework: net10.0
• .NET SDK: 10.0.400 (Windows)
• OS: Windows 11
• Browser used for repro: Chromium (headless, via Playwright) — same result also occurs with a normal browser session, headless was only used to script the repro

Steps to Reproduce

dotnet new install SimpleIdServer.Templates::7.0.0
dotnet new idserverui -n ReproCheck
cd ReproCheck
dotnet run --urls "http://localhost:5298"

1. Navigate to http://localhost:5298/Home/Profile (any page requiring auth works — this one is linked from the default home page)
2. You are redirected to /pwd/Authenticate?ReturnUrl=%2FHome%2FProfile
3. Enter the default seeded credentials: Login = administrator, Password = password
4. Submit the form (press Enter in the password field, or click "Authenticate")

Expected behavior

Login succeeds and the browser is redirected back to ReturnUrl (/Home/Profile).

Actual behavior

The server returns HTTP 500 with an unhandled NullReferenceException. This happens on the Index POST action of AuthenticateController, before any custom application code runs.

Stack trace

The exception is thrown two frames deep in application code, before any custom logic runs:

System.NullReferenceException: Object reference not set to an instance of an object.
   at SimpleIdServer.IdServer.UI.BaseAuthenticationMethodController`1.BuildViewModel(String realm, WorkflowRecord workflow, List`1 records, CancellationToken cancellationToken)
   at SimpleIdServer.IdServer.UI.BaseAuthenticationMethodController`1.<>c__DisplayClass17_0.<<Index>g__BuildWorkflowViewModel|1>d.MoveNext()
--- End of stack trace from previous location ---
   at SimpleIdServer.IdServer.UI.BaseAuthenticationMethodController`1.Index(String prefix, T viewModel, CancellationToken token)

Full stack trace (including the rest of the ASP.NET Core middleware pipeline) is attached: error-page-full.txt

Relevant server console log (around the failing request)

fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.NullReferenceException: Object reference not set to an instance of an object.
         at SimpleIdServer.IdServer.UI.BaseAuthenticationMethodController`1.BuildViewModel(String realm, WorkflowRecord workflow, List`1 records, CancellationToken cancellationToken)
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished HTTP/1.1 POST http://localhost:5298/pwd/Authenticate?ReturnUrl=%2FHome%2FProfile - 500 - text/html;+charset=utf-8 68.4437ms

Full console log from server startup through the failing request is attached: server-console.log

Workaround

Downgrading to SimpleIdServer.Templates 6.0.6 (which generates a project targeting net8.0) resolves the issue — the exact same login flow (same credentials, same generated Program.cs aside from the template's own version-specific scaffolding) completes successfully end-to-end (login → consent → authorization code → token exchange).