Hello,
We have a pretty weird issue with access tokens.
Here is the scenario:
We use our own Authorization Service with it is own Sign-In page and this service communicates with Okta API. We implemented API-based user login flow based on documentation.
User A launches Web Application A and this application redirects user to our internal Authorization Service Sign-In form.
User A enters username and password and clicks “Sign-In” button.
Authorization Service back-end performs Primary Authentication request:
Request:
curl -v -X POST
-H “Accept: application/json”
-H “Content-Type: application/json”
-d ‘{
“username”: “userA@test.com”,
“password”: “1234567Aa!”
}’ “https://xxx.okta.com/api/v1/authn”
Response:
{
“expiresAt”:“2019-01-24T21:45:02.000Z”,
“status”:“SUCCESS”,
“sessionToken”:"<session_token>",
“_embedded”:{
“user”:{
“id”:“1234567890”,
“passwordChanged”:“2019-01-24T20:14:30.000Z”,
“profile”:{
“login":"userA@test.com”,
“firstName”:“Test”,
“lastName”:“User A”,
“locale”:“en”,
“timeZone”:“America/Los_Angeles”
}
}
}
}
Authorization Service back-end extracts Session Token value from the response and gets authorization code by session:
Request:
curl -v -X GET
-H “Accept: application/json”
“https://xxx.okta.com/oauth2/{authorizationServerId}/v1/authorize?client_id={clientId}&scope=openid offline_access&sessionToken={sessionToken}&response_type=code&state={state}&redirect_uri={redirectUri}”
Authorization Service back-end handles request redirect, extracts code parameter from the query string and redirects client application to the Web Application A with code in the query string parameter.
Web Application A exchanges the authorization code for tokens with our internal Authorization Service.
Authorization Service back-end exchanges the authorization code for tokens with Okta API:
Request:
curl -v -X POST
-H “Accept: application/json”
-H “Content-Type: application/x-www-form-urlencoded”
-H “Authorization: Basic MG9hY…”
-d ‘grant_type=authorization_code&redirect_uri={redirectUri}&code={code}’
“https://xxx.okta.com/oauth2/{authorizationServerId}/v1/token”
Response:
{
“access_token”:“eyJra…”,
“token_type”:“Bearer”,
“expires_in”:3600,
“scope”:“openid offline_access”,
“refresh_token”:“TJEV…”,
“id_token”:“eyJra…”
}
This works as expected, but…
If, a second later, User B performs the same action; we receive Access and Id tokens for User A, not User B. This is pretty strange and we cannot find an explanation in documentation which explains why it happens and/or how to fix it.
Could you please clarify why it happens and help us solve the problem? Maybe something is not configured correctly in our Okta account?
