Token is missing in the FWSTrace.log when creating OAuth partnership
Article ID: 190915
Updated On:
Products
Issue/Introduction
We're running Federation Services on CA Access Gateway (SPS) as OIDC
Client and when the Federation Service tries to get authorized the
user, it reports error :
[05/06/2020][14:35:38][9228][3636][1e1730a0-79e424d3-9010853e-ebdea477-d86c603c-d33]
[MessageDispatcher.java][dispatchMessage][Sending
the following message to the remote entity:
[Message: /oauth2/v1/userinfo?code id_token
token=eyJraWQiOiJHd2ZZZkd3WE5WWGdMQmxoZ0hLV29zSGtKemlldnhrMTJuMS1tZUFCTFBJIiwiYWxn
[...]
78odWvKM1ScpR75KLVPg].]
[05/06/2020][14:35:40][9228][3636][][SSLHandler][readFully][Full Message HTTP/1.1
400 Bad Request
Date: Wed, 06 May 2020 14:35:46 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 226
Connection: close
Server: Apache
Public-Key-Pins-Report-Only: pin-sha256="r5EfzZxQVv [...] fdT2zt8=";
pin-sha256="MaqlcUgk2mvY/RFSGeSw [...] vnQ=";
pin-sha256="72G5IEvDEWn+ETh [...] nO6iyJI=";
pin-sha256="rrV6CLCCvqnk89g [...] oiVTjCOg=";
max-age=60; report-uri="https://myoidcprovider.mydomain.com/report"
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
]
[05/06/2020][14:35:40][9228][3636][1e1730a0-79e424d3-9010853e-ebdea477-d86c603c-d33]
[FWSBase.java][authenticateUser][result code from AgentAPI login call: 2]
[05/06/2020][14:35:40][9228][3636][1e1730a0-79e424d3-9010853e-ebdea477-d86c603c-d33]
[FWSBase.java][processFailedAuthentication][ 255:UserState=UserNotFound]
[05/06/2020][14:35:40][9228][3636][1e1730a0-79e424d3-9010853e-ebdea477-d86c603c-d33]
[TokenConsumer.java][authenticateUser][OAuth
Authorization and Single Sign-on Authentication returned 1]
How can we fix that ?
Environment
CA Access Gateway (SPS) 12.8SP0CR0 on Windows 2012R2;
Policy Server 12.8SP0 Windows 2012R2;
Resolution
In the Partnership "myOidcPartnership" :
- Set "Access Token Query Parameter" to "access_token";
- Set "Supported Access Token Types" to "Bearer" and remove the
other ones;
This will make the request properly to request an access_token.
Feedback
