-
oidcc version3.2.4 Erlang version27.1 Elixir version1.17.3-otp-27 SummaryAfter creating a realm and a client, I keep getting {:error,
{:http_error, 401,
%{
"error" => "invalid_request",
"error_description" => "Authentication failed."
}}}when running The openid-configuration is being retrieved successfully. OpenId Provider: Keycloak 22.0.5 Current behaviorCalling {:error,
{:http_error, 401,
%{
"error" => "invalid_request",
"error_description" => "Authentication failed."
}}}How to reproduceOn Keycloak 22.0.5
{:error,
{:http_error, 401,
%{
"error" => "invalid_request",
"error_description" => "Authentication failed."
}}}Expected behaviorCalling {:ok, redirect_url} = Oidcc.create_redirect_url(MyApp.OpenIdConfigurationProvider, "test1", client_secret, %{redirect_uri: "http://localhost:8080/oidc/callback"}) |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 8 replies
-
|
@GPrimola Thanks for the report. Can you please put the full Given the specific error / location, I believe that this is happening when attempting to execute PAR It looks like Keycloak is responding with 401 on that PAR request. That hints, that you have either provided the wrong credentials or configured something else wrong in Keycloak /
If the error was a different 4XX error like Bad Reuest (400), it would be likely that this is a bug. A 401 however hints at a configuration error like an invalid client secret. One issue I've seen with multiple identity providers is incorrect encoding of the client secret. Can you check if your secret contains special characters like |
Beta Was this translation helpful? Give feedback.
-
|
@GPrimola The request contain the client assertion. That is a safer way of handling auth than just sending the secret. oidcc should only use assertions instead of the secret if the provider signals support. Can you send me the openid introspection? (You can redact the URLs, I’m interested in the authentication parts of it.) |
Beta Was this translation helpful? Give feedback.
-
|
(FYI: The related RFC mentions exactly the described fields you observed: https://datatracker.ietf.org/doc/html/rfc9126#section-2.1) |
Beta Was this translation helpful? Give feedback.
-
|
Absolutely! request: client_assertion: client_assertion_type: openid-configuration: |
Beta Was this translation helpful? Give feedback.
-
|
Based on this (can't check if the secret is correct, I'll just take your word for it), I believe Keycloak is not specification compliant. https://www.ietf.org/archive/id/draft-ietf-oauth-par-03.html#name-pushed-authorization-reques
The relevant configuration you provided includes
Based on this, I would take the following steps:
|
Beta Was this translation helpful? Give feedback.
-
|
@maennchen thanks for the reply. I can assure you the client_secret is 100% correct, as I've validated the pair client_id/secret with the I tried to do the workaround you proposed, however:
|
Beta Was this translation helpful? Give feedback.
-
|
Oh, there’s no current value to override something to nil. In that case override the auth methods. I shoud probably have a look at that though so that it is possible. |
Beta Was this translation helpful? Give feedback.
Based on this (can't check if the secret is correct, I'll just take your word for it), I believe Keycloak is not specification compliant.
https://www.ietf.org/archive/id/draft-ietf-oauth-par-03.html#name-pushed-authorization-reques
T…