401 Unauthorized

sart96 · October 29, 2019, 2:57pm

Dear Okta developers,

I am trying to set up a SPA in Okta using Angular 8 and Spring Boot. I specify the following in my spring boot application.yml file:

okta:
oauth2:
issuer: https://{our-company-name}.okta.com
client-id: {client-id-I-created-for-this-SPA}

In the blog post I followed, Matt Raible also adds /oauth2/default but after reading the question on this forum, I found that /oauth2/default should be removed when MFA is enabled and it is enabled in my app and everything works fine.

In the Angular 8 application, I have

const config = {
issuer: ‘https://{our-company-name}.okta.com’,
redirectUri: ‘localhost:4200/implicit/callback’,
clientId: ‘{client-id-I-created-for-this-SPA}’
};

localhost:4200 is added to trusted origins, login redirect URI is also configured in Okta admin.

I am able to log into the application with MFA, but backend returns 401 status.

I appreciate your help.

mraible · October 29, 2019, 10:04pm

You’ll want to use an issuer with /oauth2/default. Otherwise, you can’t validate the token. I’m not sure how MFA fits into everything, but I know this will work if you’re not using MFA.

sart96 · October 29, 2019, 11:11pm

Hi Matt, thank you for your reply. If I leave /oauth2/default on my issuer, then I am facing the exact same problem described here: https://devforum.okta.com/t/the-requested-feature-is-not-enabled-in-this-environment/638. Please please share any ideas that might resolve this.

I really appreciate your time. Thank you!

dragos · October 29, 2019, 11:28pm

Hi @sart96

The error appears because your Okta tenant does not have API Access Management feature enabled through which you can create custom authorization servers with custom scopes and claims. Access tokens created through this authorization servers can be verified locally as the signing keys for them are returned under /keys endpoint.

This feature is free for developer and preview tenants, but paid in production ones. If you would like to have this feature enabled on your production tenant, please reach out to your Okta representative. If you would like to test the feature, you can register a free Okta developer tenant here.

sart96 · October 29, 2019, 11:42pm

Hi @dragos, thank you for your response. I am strictly following this post to configure my Angular 8 and Spring Boot applications. I am creating a SPA and using only the issuer and client-id to generate access token in Angular and decode in Spring Boot application. Do you think I should open a case in support for this?

Thank you very much for your attention.

dragos · October 29, 2019, 11:56pm

Hi @sart96

Can you please check with a developer tenant if you are able to run the application successfully? If it works, then the API Access Management feature would need to be enabled on your production tenant.

If the application doesn’t work with the developer tenant, please feel free to send us an email to developers@okta.com and one of our Developer Support Engineers will further assist you.

sart96 · October 30, 2019, 12:23am

I created an OIDC App in Okta as explained in the blog post. I do not know why access token cannot be verified in the Spring Boot Application even though I can login to the Angular App and view the UI.

Ok, thank you very much.

dragos · October 30, 2019, 12:29am

Hi @sart96

Due to RFC restrictions, the Okta authorization server does not return the signing keys for access tokens. As such, access tokens issued through this authorization can not be verified locally.

sart96 · October 30, 2019, 7:58pm

Hi @dragos
I have read your response here and for Single Page Apps, I am using the Okta authorization server instead of a custom authorization server. I specify the issuer to be https://{company-name}.okta.com/oauth2/v1/authorize. Now I have a ‘blocked by CORS policy’ error even if I have added the required url to trusted origins.

Any suggestions to what can be done to resolve this?

Thank you very much for help.

dragos · October 30, 2019, 9:45pm

Hi @sart96

Can you give a screenshot from the browser’s JavaScript console with the error or the message that it shows? I am curious to see the endpoint that the script is trying to access through CORS.

sart96 · October 30, 2019, 11:09pm

This is what I have. Thanks for help!

dragos · October 30, 2019, 11:17pm

Hi @sart96

Thank you for providing the screenshot. The endpoint that you are trying to access is actually composed from two endpoints /oauth2/v1/authorize and /api/v1/authn. When joining together, Okta will return a 404 error.

We need to do first a request to /api/v1/authn to authenticate the user, after which we can do a request to /oauth2/v1/authorize (or /oauth2/{auth_server}/v1/authorize.

sart96 · November 8, 2019, 3:13am

Hi @dragos,

We have created a custom auth server after enabling API Access Management.

Should the issuer in the below config for the Angular 8 app be https://{company-name}.oktapreview.com/oauth2/{auth-server-id} or just https://{company-name}.oktapreview.com ?

const config = {
issuer: ‘https://{company-name}.oktapreview.com’,
redirectUri: ‘{app-host}/implicit/callback’,
clientId: ‘{client-id-I-created-for-this-SPA}’
};

When I try with https://{company-name}.oktapreview.com without /oauth2/{auth-server-id} in the Angular 8 app config and https://{company-name}.oktapreview.com/oauth2/{auth-server-id}/v1/authorize in the config of Spring Boot app, it is still failing and I am getting 401 Unauthorized error.

We are hosting the app on http, not https. Can this be the reason why this is not working?

I appreciate your time and effort. Thank you very much!

dragos · November 8, 2019, 6:27am

Hi @sart96

Regarding your first question, you need to set up the issuer to https://{company-name}.oktapreview.com/oauth2/{auth-server-id} .

Regarding your second question, can you please open a support ticket with us at developers@okta.com in order to have a look together at the logs and see the sequence of calls and what are the next steps to resolve this?