Agama flow and authorization code for the token enpoint #6618
Replies: 16 comments 5 replies
-
|
Adding @jgomer2001 or @maduvena for comments. |
Beta Was this translation helpful? Give feedback.
-
|
If your agama flow finished successfully, the browser will be taken to the redirect uri you passed when the flow was triggered. That one has to have to code |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much for your reply! I had a form displaying a "login success" message before the Finish statement and I believe it was the reason why the redirection was not occurring. I've removed this form from the flow and now the redirection takes place but ending up with this: https://FQDN/admin?error_description=The+Authorization+Server+requires+End-User+authentication.+This+error+MAY+be+returned+when+the+prompt+parameter+in+the+Authorization+Request+is+set+to+none+to+request+that+the+Authorization+Server+should+not+display+any+user+interfaces+to+the+End-User%2C+but+the+Authorization+Request+cannot+be+completed+without+displaying+a+user+interface+for+user+authentication.+CorrelationId%3A+27cb0920-508e-432a-98f8-898cc404e483&hint=Create+authorization+request+to+start+new+authentication+session.&error=login_required I've checked and there is no prompt parameter in the authorization request. |
Beta Was this translation helpful? Give feedback.
-
Agama does not work like jython scripts...
Check this for more info |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the link! And checking the jans-auth server logs: The fact that the user is not found explains the failure but the question is why the user is not found since it does exist in the DB. I've also tried with the admin user that is created when installing the server thinking it could be the way I've registered my User but the result is the same, it cannot be found. By the way when I call the authenticate method in my Agama flow, the user is found...: So basically when authenticating using Java code inside the Agama flow there is no issue, the user is found and authenticated but when the flow is marked as finished the user cannot be found for the same uid. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry in the above logs I've mixed both users Arnaud and admin between the authentication and flow finish for testing. Here are the proper logs with no mix up (in bold for both lookup in DB): uth - 2023-11-24 17:56:29,767 DEBUG [qtp1492875057-22] [io.jans.agama.engine.service.FlowService] (FlowService.java:153) - Resuming flow |
Beta Was this translation helpful? Give feedback.
-
|
That's very weird how in it can't find the user in the second call. The sequence is still a little unclear. When the user gets authenticated at the external OP, does this user already exist in the Auth Server database? Are you still not able to get the code? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I still cannot get the code and left it on hold because I have no clue on how to solve it.
|
Beta Was this translation helpful? Give feedback.
-
|
Hi Arnaud Could you please share the |
Beta Was this translation helpful? Give feedback.
-
|
Hi Arnab Here it is: THX! |
Beta Was this translation helpful? Give feedback.
-
|
Hi Arnaud I have tested your
Attaching a video link here for your reference. Let me know if there is any concern. Regards, |
Beta Was this translation helpful? Give feedback.
-
|
Hi Arnab, Thank you very much for trying! And what is really weird is that the user is found once (triggered by the script) and then the search fails while it is the same UserService class and method used for the search: auth - 2023-12-19 10:48:20,833 DEBUG [qtp1492875057-21] [io.jans.agama.engine.service.ActionService] (ActionService.java:91) - Class com.toro.passclub.BasicAuthentication loaded successfully Regards, |
Beta Was this translation helpful? Give feedback.
-
I am not able to access your authorization url so not able to understand how it is working in your case. It would be helpful if you could attach an image of the page shown after authentication. |
Beta Was this translation helpful? Give feedback.
-
|
triggered by the script --- Do you mean agama script? then the search fails --- Have you written any other code to search the user again after authentication? I am asking because UserService.java is trying to get user information twice. In the second attempt, it failed. When I tested the .gama file user information was fetched only once. It would be helpful if you could attach an image of the page shown after authentication. Instead of the redirection with the code. |
Beta Was this translation helpful? Give feedback.
-
|
Also I don't know if this helps but if I enter a wrong password the low is exactly the same. From the jans-auth-script.log file: Password is correct: Password is wrong |
Beta Was this translation helpful? Give feedback.
-
|
I am not able to reproduce this error :-|. I am getting authorization
|
Beta Was this translation helpful? Give feedback.
-
|
Are we sure this client is correct? Can you export the client JSON and paste it here? From the TUI you can do this by pressing |
Beta Was this translation helpful? Give feedback.
-
|
Please find it in attachment |
Beta Was this translation helpful? Give feedback.
-
|
@toroarnaud , how old is your jans insatallation? There is a release happening every week so I would recommend testing with the latest installation. You can check on my temporary installation and let me know if it works for you. Here is the authorization url. username: admin |
Beta Was this translation helpful? Give feedback.
-
|
@toroarnaud As suggested by @duttarnab, have you tried the same scenario on recent builds? Do you still see the problem? Please post an update here if you are still pursuing this. Else I would like to close this discussion in a couple of days more. |
Beta Was this translation helpful? Give feedback.
-
|
Hi and first sorry for the late reply! |
Beta Was this translation helpful? Give feedback.
-
Hi,
I am trying with an Agama flow to do an openid authentication as we do it with an interception script.
My Agama flow is working fine, I can create users and authenticate them. The flow is triggered with an openid authentication request of the form:
https:///jans-auth/restv1/authorize?acr_values=agama&agama_flow=flow-qname&scope=...&response_type=...&redirect_uri=https...&client_id=...
The problem is I don't see how to get the code used to obtain an access token.
When using an interception script, after successful authentication of the user we are redirected to the redirect_uri (passed as parameter to the authorize endpoint) which includes the authorization code.
I am sure I am missing something in the logic when using the Agama flow and it would be nice if someone could tell me how to obtain this authentication code.
Thank you!
Beta Was this translation helpful? Give feedback.
All reactions