To GoodData homepage

Replies posted by Peter Plochan

2 Replies

scott.jacobsen
scott.jacobsenParticipating Frequently
asked in SDKs and APIs

OIDC silent login failure

According to our logs, it seems there’s a missing name claim in the ID token. The GD backend uses the ID token for getting a user info (name) of the already authenticated session instead of the userinfo endpoint.Could you, please, try to add at least the name claim to the ID token as well? It seems there’s a how-to in the already mentioned doorkeeper’s README.

6
scott.jacobsen
1 year ago
scott.jacobsen
scott.jacobsenParticipating Frequently
asked in SDKs and APIs

OIDC silent login failure

Hi @scott.jacobsen,the invalid_nonce error code from the www-authenticate header means there was a problem with the nonce parameter. Our GD backend expects a proper value of this parameter which must be located within the ID Token returned by the OIDC provider.Does your “doorkeeper-openid_connect” support sending this parameter? I’ve found some mention about enabling nonces in the related GitHub README, but I’m not sure if it will help. Could you try it?More info about the nonce within the OIDC standard:nonceOPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.

6
scott.jacobsen
1 year ago
Welcome to the GoodData Community!Cookie settings