Client authentication failed

[aravindc26]

These are my environment variables.

SECRETS_SYSTEM=nnXz52aAjQRIiID7ov4tRH5HZuKfQk9t
SERVE_ADMIN_HOST=localhost
SERVE_ADMIN_CORS_DEBUG=true
SERVE_ADMIN_ACCESS_LOG_DISABLE_FOR_HEALTH=false
SERVE_ADMIN_TLS_ENABLED=false
SERVE_PUBLIC_HOST=localhost
SERVE_PUBLIC_ACCESS_LOG_DISABLE_FOR_HEALTH=false
DSN="mysql://root:@tcp(docker.for.mac.localhost:3306)/hydra"
OAUTH2_INCLUDE_LEGACY_ERROR_FIELDS=true

When I make a call to /oauth2/token , I used Basic Auth to send client Id and secret. I got this error message.

{
    "error": "invalid_client",
    "error_description": "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).",
    "status_code": 401
}

Can I know What I'm doing wrong here ?

[aravindc26]

Hi @vinckr, please help with this.

[aeneasr]

Can you please list all the commands you used to create the client, and the command you used to authenticate the client?

[aravindc26]

curl --location --request POST 'http://localhost:9001/clients' \
--header 'Content-Type: application/json' \
--data-raw '{
    "client_name": "Test2",
    "client_secret": "123456789",
    "token_endpoint_auth_method": "none",
    "grant_types": ["client_credentials"]
}'

Response:
{
    "client_id": "10bec1f2-476c-467a-8b19-399e79601f8d",
    "client_name": "Test2",
    "redirect_uris": null,
    "grant_types": [
        "client_credentials"
    ],
    "response_types": null,
    "scope": "offline_access offline openid",
    "audience": [],
    "owner": "",
    "policy_uri": "",
    "allowed_cors_origins": [],
    "tos_uri": "",
    "client_uri": "",
    "logo_uri": "",
    "contacts": null,
    "client_secret_expires_at": 0,
    "subject_type": "public",
    "jwks": {},
    "token_endpoint_auth_method": "none",
    "userinfo_signed_response_alg": "none",
    "created_at": "2021-12-29T05:53:20Z",
    "updated_at": "2021-12-29T05:53:20.666918Z",
    "metadata": {}
}

curl --location --request PATCH 'http://localhost:9001/clients/10bec1f2-476c-467a-8b19-399e79601f8d' \
--header 'Content-Type: application/json' \
--data-raw '[{"op": "replace", "path": "/token_endpoint_auth_method", "value": "client_secret_post"}, { "op": "remove", "path": "/scope" }]'

Response:
{
    "client_id": "10bec1f2-476c-467a-8b19-399e79601f8d",
    "client_name": "Test2",
    "client_secret": "$2a$10$CeTA4xpj8A8oEOnxVn1sA.dd0nbcp244zDeNdMay3RGeJ2ngeJxTS",
    "redirect_uris": [],
    "grant_types": [
        "client_credentials"
    ],
    "response_types": [],
    "scope": "offline_access offline openid",
    "audience": [],
    "owner": "",
    "policy_uri": "",
    "allowed_cors_origins": [],
    "tos_uri": "",
    "client_uri": "",
    "logo_uri": "",
    "contacts": [],
    "client_secret_expires_at": 0,
    "subject_type": "public",
    "jwks": {},
    "token_endpoint_auth_method": "client_secret_post",
    "userinfo_signed_response_alg": "none",
    "created_at": "2021-12-29T05:53:20Z",
    "updated_at": "2021-12-29T05:56:10.946296Z",
    "metadata": {}
}

curl --location --request POST 'https://localhost:9000/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=10bec1f2-476c-467a-8b19-399e79601f8d' \
--data-urlencode 'client_secret=123456789'

Response:
{
    "error": "invalid_client",
    "error_description": "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).",
    "status_code": 401
}

[aeneasr]

You might be experiencing #2869 which is resolved on master but not yet released!

[aravindc26]

Thank you very much, this helped !

[aeneasr]

You're welcome :)