OIDC extension fails with Okta OIDC #7129
Comments
|
A little more info, debugging Unauthorized: {"error":"invalid_request","error_description":"Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client_assertion in the post body."} |
|
@moksamedia Hi, thanks for the thorough analysis, I believe it has been fixed with Quarkus https://github.com/quarkusio/quarkus/tree/1.3.0.Alpha1, can you please try it ? |
|
@sberyozkin That does work, thanks. For posterity, here are the application.properties settings I used. I had to change the Okta auth server URL from This is using Role-based auth on a @Path("/secured")
@RolesAllowed({"Everyone"})
public class SecureResource {
@GET
@Produces(MediaType.TEXT_PLAIN)
public String hello() {
return "hello";
}
} |
|
@sberyozkin Two questions:
|
|
@moksamedia Thanks for the update. Can you please check if the alternative option works and update #5827 if not ?
I don't know, hopefully soon enough.
Nonetheless it worked for some users, and it really depends on the way the protected application interacts with the users. The primary purpose was to ensure the clients can be whitelisted based on the specific redirect URI value as asked by Aaron. Hope it helps, I'd like to close this issue soon, likely tomorrow due to a time difference |
|
I only added the thing about changing the Okta endpoint so that if someone else found this trying to figure things out, they'd have correct info. It was my mistake. I don't think it's a problem with the OIDC extension. I'll close the ticket. |
|
Hey @moksamedia @gsmet I'am testing the 1.3.0.Alpha2 version with oidc security dependency. When I enter the login/Password, i have the same behaviour with cyclic 302 between the Auth Server SSO (forgerock) and my front, and at the end nothing is displayed.
My config properties :
Another thing, that i could not explain, is if I put a breakPoint on line 186 io.quarkus.oidc.runtime.CodeAuthenticationMechanism.java and after the login a wait 3 sec. All are ok and the cyclic behaviour disappears.
And in log, i have this : 2020-02-28 01:41:32,076 WARNING [io.ver.cor.imp.BlockedThreadChecker] (vertx-blocked-thread-checker) Thread Thread[vert.x-eventloop-thread-1,5,main]=Thread[vert.x-eventloop-thread-1,5,main] has been blocked for 3002 ms, time limit is 2000 ms: io.vertx.core.VertxException: Thread blocked Do you have a solution for me please ? Thanks. |
|
I'm still having an issue getting the OIDC client to work with Okta. I'm using 1.3.0.CR2. I created an app using the following command: Then I created a "Web" app on Okta and set the login redirect URI to be It redirects me to log in successfully, but when it comes back to the app, it gives me a 401.
|
|
@mraible I have the same problem. I specified the redirect-path but when it's called this url don't have the HTTPS protocol. My configuration : The location in request is :_ Expected location is : Do you have a solution for me please? I use 1.3.1.Final Quarkus version. Thanks. |
Describe the bug
OIDC extension configured to use Okta OIDC is stuck in a redirect loop. The code is never exchanged for a token. The OIDC app configuration works with OIDC Debugger.
application.propertiesNetwork redirects:
Environment (please complete the following information):
uname -aorver:Linux pop-os 5.3.0-7625-generic Modify BeanArchiveProcessor so that implicit bean archives are added to #27
157677456019.10~f432cd8-Ubuntu SMP Thu Dec 19 20:35:37 UTC x86_64 x86_64 x86_64 GNU/Linuxjava -version:openjdk version "11.0.5" 2019-10-15
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.5+10)
Eclipse OpenJ9 VM AdoptOpenJDK (build openj9-0.17.0, JRE 11 Linux amd64-64-Bit Compressed References 20191016_358 (JIT enabled, AOT enabled)
OpenJ9 - 77c1cf708
OMR - 20db4fbc
JCL - 2a7af5674b based on jdk-11.0.5+10)
Additional context
Project created with this command:
One resource:
The text was updated successfully, but these errors were encountered: