Nonce is invalid in id_token

Questions OAuth/OIDC
1

I’m writing a custom OIDC integration. For the last step, where Okta exchanges a code for a token, I’m getting the following error after responding from /token endpoint:

com.saasure.platform.services.idp.exception.IdpAuthenticationException: Nonce is invalid in id_token

These are the claims in my jwt id token:

{
  "iat": 1712764572,
  "sub": "test@test.com",
  "jti": "8285bc11-2668-4ead-b007-495c20d522af",
  "nonce": "dRQR84bgeg1R9wxoePFaOaYsCSOIkVfr",
  "at_hash": "I1DWSlQIvpt_PJl3UqaM_w",
  "family_name": "••••",
  "given_name": "••••",
  "nbf": 1712764572,
  "exp": 1712764872,
  "iss": "Acme",
  "aud": "Acme"
}

I don’t see any reason for nonce to not be valid, so I’m suspecting the error message is wrong. Anyone has any idea what might be the issue with the claims?

2

OK I now understand that Okta expects the nonce to match the one given initially in the /auth endpoint.

2 Likes
4

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.