siteminder solution as OIDC authorization provider: POST request to /token endpoint

Products

• SITEMINDER

Issue/Introduction

We have recently configured the siteminder solution as OIDC authorization provider and configuring a client for Authorization code grant flow.

While making a request to /authorization end point , we are successfully able to obtain code on the configured redirect_uri (hitting a get request in browser and after successful user challenge/authentication)

After that , when we are requesting a POST on /token endpoint , it loads the login page configured for our authentication scheme.

Are we supposed to add SMSESSION cookie to the POST request?

Are any other cookies required in this request?

Do you have any sample request response formats for this use case?

Environment

Release : 12.8

Component : SiteMinder

Resolution

In the POST request SMSESSION cookie is nor required. But you need to provide authorization code in the request. Without it such error is returned:

{
"error": "invalid_request",
"error_description": "Specify authorization_code as grant_type."
}

POST request should have the following headers:

content_type=application/x-www-form-urlencoded
basic_auth=(null)
bearer_token=(null)
ssl_validate_server=0
timeout=60
outgoing_proxy=(null)
pass_cookies=0
ssl_cert=(null)
ssl_key=(null)
referer: https://refererURL/

POST data, something like this:

grant_type=authorization_code
code=NDBiM2MwOGEtNDkIUNBJxNy00YjZmLThlNjMtMmFiNjViNjU5MDY4LVRXTE5vTwfw241Q2lyOFRmR2wwcFhHaHAwR0Rqaz0%3D
redirect_uri=https%3A%2F%2FMyoidc.demo.lab%2Fprotected%2Fredirect
state=6t_SkbyLmv3NuLmUlTXXEesiAd8
client_id=2ed8e81e-48da-4276-1ffa-c94c8d5d79f1
client_secret=tHOi4xqwgWRGa00mPLHOGg8evXFegreyC%2Fc%2Fbp6ltEJts4%3D