So the Authentication Request for me is the following GET query:
https://ce.gluu.info/oxauth/seam/resource/restv1/oxauth/authorize?response_type=code&client_id=%40%212D47.9549.29A6.B254%210001%214D90.88A3%210008%21D669.6616&redirect_uri=http%3A%2F%2Flocalhost%3A11223%2Fiv.dev%2FoauthCallback.html%3Fclient_name%3DOidcClient&scope=openid+profile+email&state=dhAoi0nSYG1xKj8YzTOufTSW3HSPmqFJm1WDVS0c1jk&display=page
just for readability the query params before encoding them are:
{
scope=openid profile email,
response_type=code,
client_secret=58436331-f7a0-4f35-aa8b-a7af187e7d88,
redirect_uri=http://localhost:11223/iv.dev/oauthCallback.html?client_name=OidcClient, state=dhAoi0nSYG1xKj8YzTOufTSW3HSPmqFJm1WDVS0c1jk,
client_id=@!2D47.9549.29A6.B254!0001!4D90.88A3!0008!D669.6616
}
From it I've got authorisation code:
d26c05ff-f442-4281-962c-a65f8a8edd76
and state:
dhAoi0nSYG1xKj8YzTOufTSW3HSPmqFJm1WDVS0c1jk
Then there is a token query made:
url: https://ce.gluu.info/oxauth/seam/resource/restv1/oxauth/token
query:
grant_type=authorization_code&
code=d26c05ff-f442-4281-962c-a65f8a8edd76&
redirect_uri=http%3A%2F%2Flocalhost%3A11223%2Fiv.dev%2FoauthCallback.html%3Fclient_name%3DOidcClient&
client_id=%40%212D47.9549.29A6.B254%210001%214D90.88A3%210008%21D669.6616
authorisation: Basic JTQwJTIxMkQ0Ny45NTQ5LjI5QTYuQjI1NCUyMTAwMDElMjE0RDkwLjg4QTMlMjEwMDA4JTIxRDY2OS42NjE2OjU4NDM2MzMxLWY3YTAtNGYzNS1hYThiLWE3YWYxODdlN2Q4OA==
method: POST
So the answer from the second:
{"error":"invalid_client","error_description":"Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the Authorization request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the WWW-Authenticate response header field matching the authentication scheme used by the client."}
with wwwAuthenticate "Basic realm="oxAuth"" (id=693)
So the second one fails :/ Is it wrong? Is it possible that the first passes but it is wrong? I mean the first one should verify if the client is right, shouldn't it?