apache / apache/jmeter

Can't access Token with OpenID Connect authorization code flow

Open
#6,227 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
9.5k
Forks
2.3k
Avg merge
1d 22h
Merged PRs (30d)
5

Description

Hello. I'm attempting to access the Token endpoint, following the required steps, corresponding to the OIDC Authorization code flow:

1. GET request to the desired page

2. GET request to the _/auth/realms/____/protocol/openid-connect/auth_ endpoint
And from the response body I extract **session_code**, **execution** and **tab_id**.

3. A second GET request to the _/auth/realms/____/protocol/openid-connect/auth_ endpoint
As parameters I provide the values for: **response_type**, **client_id** and **code_challenge_method** and from the generated URL I extract the values for **state**, **code_challenge** and **nonce**

4. POST request to the authentication endpoint, using the generated variables:
_/auth/realms/____ _/login-actions/authenticate?session_code=${session_code}&execution=${execution}&client_id=______&tab_id=${tab_id}_
and in body data I provide the required username and password.

5. I extract the **code** from the Response headers of the previous request

6. Send a POST request to the Token endpoint, using the code + a code verifier, generated using the code challenge + the hash method.

**Expected result:** Access token is displayed in response
**Actual result:** An error message {"error":"invalid_grant","error_description":"User session not found"} is displayed

The same flow is working successfully in Postman. I can't seem to figure out the reason behind it. Any help would be highly appreciated.

JMeter Version:
8.6.2

Java Version:
1.8.0_391

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.