Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

While making access token exchange call to Dex /userinfo API is giving 403 Forbidden #3493

Open
3 tasks done
kuriman01 opened this issue Apr 24, 2024 · 2 comments
Open
3 tasks done

Comments

@kuriman01
Copy link

kuriman01 commented Apr 24, 2024

Preflight Checklist

  • I agree to follow the Code of Conduct that this project adheres to.
  • I have searched the issue tracker for an issue that matches the one I want to file, without success.
  • I am not looking for support or already pursued the available support channels without success.

Version

2.39.0

Storage Type

Kubernetes

Installation Type

Official Helm chart

Expected Behavior

When making access token exchange call using the IDP access token to DEX it must return a new access token in response.

Note: we are using client credential flow to obtain access token from IDP

Actual Behavior

When making access token exchange call to DEX following error is bring returned {HTTP Status: 401 unauthorized. Response: {"error":"access_denied"}}. In Dex logs it is showing the following message "level=error msg="failed to verify subject token: oidc: error loading userinfo: 403 Forbidden: "

Steps To Reproduce

  1. Obtain access token from upstream IDP(Okta)
  2. Making access(obtained access token from upstream) token exchange call to Dex to get new access token generated by Dex.
  3. Return status code 401 with error {"error": "access_denied"}

Additional Information

curl --location 'http://{{DEX_URL}}/dex/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--header 'Authorization: Basic MG9hMjF2bjc4eTBhVDBzN2Ywxxxxx'
--data-urlencode 'connector_id=okta'
--data-urlencode 'scope=profile groups openid email'
--data-urlencode 'requested_token_type=urn:ietf:params:oauth:token-type:access_token'
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange'
--data-urlencode 'subject_token=xxxxxxx4QUtnNWl0RmpLOmp0aSI6IkFULnNFxxxxxxxxxxxxxxxxxxxxxxxx'
--data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:access_token'

Configuration

No response

Logs

No response

@scott-sudweeks
Copy link

scott-sudweeks commented Nov 12, 2024

I am also experencing this issue. Logs from Okta show a successful user login and a successful issuance of an access token to Dex.

However Dex does not return it to the user.

@nabokihms
Copy link
Member

access_denied looks like a response from Okta, which we cannot debug without seeing the connector settings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants