Getting a 400 from the /authorize endpoint when using the GLAM dev environment
Categories
(Infrastructure & Operations :: SSO: Issues, task)
Tracking
(Not tracked)
People
(Reporter: robotblake, Unassigned)
References
Details
When accessing https://glam-dev.bespoke.nonprod.dataops.mozgcp.net I get a 400 when the SPA calls the https://auth.mozilla.auth0.com/authorize endpoint.
If I replay the request with the redirect_uri param changed to http://localhost:5000 than the request returns correctly.
Bug 1605507 is where the dev domain was added.
|
||
Comment 1•6 years ago
|
||
It had https://glam-dev.bespoke.nonprod.dataops.mozgcp.net/ in the list of allowed callback URLs, but I just added it again without the trailing slash, which the localhost:5000 entry doesn't have. Perhaps that fixes it?
|
|
Reporter | |
Comment 2•6 years ago
|
||
Hrm, doesn't seem to have resolved the issue. The weird thing is that if I replace the redirect_uri param to something else not in the list I get a 403, not a 400.
|
|
||
Comment 3•6 years ago
|
||
Needinfo gene and April - are either of you able to help debug this? I don't know much about client implementation side of things.
|
||
Comment 4•6 years ago
|
||
:robotblake
:robotblake Was this previously working and then it stopped or has this never worked?
:jabba I see the error
[16:17:34.767Z] INFO wt: Client Doy3pSTMj7yfSP2yaVpIcCNPcXtubdDh is not OIDC conformant yet, please fix!
which may mean that this RP setup has the same problem as called out here
Also, was this client setup for PKCE flow since it looks like that's what it's using
|
|
||
Updated•6 years ago
|
|
|
Reporter | |
Comment 5•6 years ago
|
||
The app is using https://github.com/auth0/auth0-spa-js which does appear to be for the PKCE flow.
It currently works when running the application locally and using http://localhost:5000. Not sure it's ever worked with the glam-dev domain.
|
|
Reporter | |
Comment 7•6 years ago
|
||
Still seeing the same error. I'm wondering if maybe we should just create a new client with just the new domain name in it?
Would that be difficult to do?
|
|
||
Comment 8•6 years ago
|
||
:jabba
Also, was this client setup for PKCE flow since it looks like that's what it's using
|
|
||
Updated•6 years ago
|
|
|
||
Comment 9•6 years ago
|
||
I don't know how to check that, do you?
|
|
||
Comment 10•6 years ago
|
||
Oh, one thing I noticed is that we have multiple applications set up for this.
There is a Single Page Application with client ID Doy3pSTMj7yfSP2yaVpIcCNPcXtubdDh (this is the one where I've been making changes).
There is a machine-to-machine application with client ID fF5a9aAKSh1hp4o020ky9OXT45ae5ajP and this one only has http://localhost:5000 whitelisted as an allowed callback URL. Maybe I'm looking at the wrong one?
|
|
Reporter | |
Comment 11•6 years ago
|
||
Doy3pSTMj7yfSP2yaVpIcCNPcXtubdDh is the one I've been using. I believe we were going to maybe use the machine-to-machine client but changed course at some point in development.
|
|
||
Comment 12•6 years ago
|
||
Ok I've fixed this.
The error that Auth0 reports when that 400 is served is
The specified redirect_uri 'https://glam-dev.bespoke.nonprod.dataops.mozgcp.net' does not have a registered origin.
The cause of this is that the allowed web origin entered into Auth0 was
https://glam-dev.bespoke.nonprod.dataops.mozgcp.net/
when it should have been
https://glam-dev.bespoke.nonprod.dataops.mozgcp.net
Feel free to re-open this ticket if there's another problem.
Description
•