Getting error while trying to connect Kratos to UAE Pass as Social Sign. #3884

rohit-patel-tw · 2024-04-19T10:03:27Z

rohit-patel-tw
Apr 19, 2024

I am trying to use Generic OIDC to connect Kratos to UAE Pass. But I am getting error:

"error": {
    "code": 500,
    "status": "Internal Server Error",
    "reason": "Unable to initialize OpenID Connect Provider: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got \"text/html\": invalid character '<' looking for beginning of value",
    "message": "An internal server error occurred, please contact the system administrator"
  }

Below is my kratos config for OIDC:

oidc:
     config:
       providers:
         - client_id: sandbox_stage
           client_secret: sandbox_stage
           id: u6ZEcp7W
           issuer_url: https://stg-id.uaepass.ae/
           auth_url: https://stg-id.uaepass.ae/idshub/authorize
           token_url: https://stg-id.uaepass.ae/idshub/token
           label: uea-pass
           mapper_url: https://storage.googleapis.com/bac-gcs-production/0d878eabc6b5fb37a6e1f35ab40c9936c2306fa273c97c452188059e2cbde2ed52bcf11287710f14ab4df68ec8afe1512807ef9d853d71b1ece53fe8656b9497.jsonnet
           provider: generic
           scope:
             - offline_access
           claims_source: userinfo
     enabled: true

Have tried with Github, and it work correctly.

From code, i see that it tries to call .well-known/openid-configuration, appending issuerUrl to it. When try to hit this in browser, it return a html page as below:

<html>
<head>
<title>Unauthorized</title>
</head>
<body>
<h1><B>Access Denied!<B><BR></H1>
<H3>Access has been blocked - if you feel this is in error, please contact the site
administrators. </H3>
</body>
</html>

Not sure, if due to this i am getting the decode error.
If, yes, how can i get this resolved.
Thanks

vinckr · 2024-04-23T14:19:15Z

vinckr
Apr 23, 2024
Maintainer

Hello @rohit-patel-tw

The error message you're seeing indicates that Ory Kratos is expecting a JSON response from the OpenID Connect Provider's discovery endpoint (usually https:///.well-known/openid-configuration), but it's receiving an HTML response instead. This is likely causing the decoding error.
The OpenID Connect Provider (in your case, UAE Pass) should return a JSON object containing various configuration information when the discovery endpoint is accessed. If it's returning an HTML page with an "Unauthorized" message, it suggests that there might be some access control or permissions issue.
Here are a few things you can try:
Check the issuer URL: Make sure the issuer URL you've provided in the configuration (https://stg-id.uaepass.ae/) is correct. The issuer URL should be the base URL of the OpenID Connect Provider.
Check the discovery endpoint: Try accessing the discovery endpoint directly in your browser (https://stg-id.uaepass.ae/.well-known/openid-configuration). If you're seeing an "Unauthorized" message, it might indicate that the endpoint requires some form of authentication.
Contact the provider: If you're unable to resolve the issue, you might need to contact UAE Pass support for assistance. They should be able to provide guidance on how to correctly configure the OpenID Connect integration.
Remember, the configuration for the OIDC method in Ory Kratos should look something like this:

oidc:
  config:
    providers:
      - id: generic
        provider: generic
        client_id: ....
        client_secret: ....
        issuer_url: https://accounts.google.com
        mapper_url: "base64://{YOUR_BASE64_ENCODED_JSONNET_HERE}"
        scope:
          - email
        claims_source: id_token
  enabled: true

In your case, you've added auth_url and token_url which are not mentioned in the Ory documentation. These fields might not be necessary as the issuer_url should be enough for Ory Kratos to discover the necessary endpoints.
If you continue to face issues, you might find the Social sign-in troubleshooting guide helpful.

1 reply

rohit-patel-tw Apr 25, 2024
Author

@vinckr I see that UAE pass does not expose https:///.well-known/openid-configuration.

But as per comments in https://github.com/ory/kratos/blob/master/selfservice/strategy/oidc/provider_config.go
it says we can use for auth_url and token_url, in case when the OAuth2 / OpenID Connect server is not supporting OpenID Connect Discovery. So, i have tried with below config for use pass, and still getting error.

oidc:
      config:
        providers:
          - client_id: sandbox_stage
            client_secret: sandbox_stage
            id: u6ZEcp7W
           #have tried both with empty string and deleting the entry completely
            issuer_url: ""
            auth_url: https://stg-id.uaepass.ae/idshub/authorize
            token_url: https://stg-id.uaepass.ae/idshub/token
            label: uea-pass
            mapper_url: https://storage.googleapis.com/bac-gcs-production/0d878eabc6b5fb37a6e1f35ab40c9936c2306fa273c97c452188059e2cbde2ed52bcf11287710f14ab4df68ec8afe1512807ef9d853d71b1ece53fe8656b9497.jsonnet
            provider: generic
            scope:
              - urn:uae:digitalid:profile:general urn:uae:digitalid:profile:general:profileType urn:uae:digitalid:profile:general:unifiedId
            claims_source: userinfo
      enabled: true

{
  "id": "2c48fa02-142b-4ec2-9be5-56ae4d97b05d",
  "error": {
    "code": 500,
    "status": "Internal Server Error",
    "reason": "Unable to initialize OpenID Connect Provider: Get \"/.well-known/openid-configuration\": unsupported protocol scheme \"\"",
    "message": "An internal server error occurred, please contact the system administrator"
  },
  "created_at": "2024-04-25T11:34:37.346379Z",
  "updated_at": "2024-04-25T11:34:37.346379Z"
}

Also, can you please clarify what does below comment on issuer_url in provider_config.go mean ?

	// IssuerURL is the OpenID Connect Server URL. You can leave this empty if `provider` is not set to `generic`.
	// If set, neither `auth_url` nor `token_url` are required.

And in case where server is not supporting OpenID Connect Discovery, what should be the value for issuer_url ?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Getting error while trying to connect Kratos to UAE Pass as Social Sign. #3884

{{title}}

Replies: 1 comment 1 reply

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Getting error while trying to connect Kratos to UAE Pass as Social Sign. #3884

rohit-patel-tw Apr 19, 2024

Replies: 1 comment · 1 reply

vinckr Apr 23, 2024 Maintainer

rohit-patel-tw Apr 25, 2024 Author

rohit-patel-tw
Apr 19, 2024

Replies: 1 comment 1 reply

vinckr
Apr 23, 2024
Maintainer

rohit-patel-tw Apr 25, 2024
Author