Okta OIDC integration NodeJS

Questions OAuth/OIDC
1

Hi,

I’m trying to use Okta to provide SSO for one of our internal NodeJS apps using the documentation: Sign users in to your web app using the redirect model | Okta Developer.

This is my config in my server file (removed the /default as we’re not using custom authorization servers as mentioned here: OpenID Connect & OAuth 2.0 API | Okta Developer):

passport.use('oidc', new Strategy({
  issuer: `https://${env.OKTA__DOMAIN}/oauth2`,
  authorizationURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/authorize`,
  tokenURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/token`,
  userInfoURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/userinfo`,
  clientID: env.OKTA__CLIENT_ID,
  clientSecret: env.OKTA__CLIENT_SECRET,
  callbackURL: 'http://localhost:1337/authorization-code/callback',
  scope: 'openid profile',
}, (issuer, profile, done) => done(null, profile)));

I’m presented with the following error:

AuthenticationError: Forbidden
    at allFailed (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:175:21)
    at attempt (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:183:28)
    at Strategy.strategy.fail (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:314:9)
    at /Users/matthias/Development/deselect-admin-back/node_modules/passport-openidconnect/lib/strategy.js:171:56
    at /Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:209:7
    at passBackControl (/Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:134:9)
    at IncomingMessage.<anonymous> (/Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:157:7)
    at IncomingMessage.emit (events.js:412:35)
    at IncomingMessage.emit (domain.js:475:12)
    at endReadableNT (internal/streams/readable.js:1333:12)
    at processTicksAndRejections (internal/process/task_queues.js:82:21)

Any ideas?

1 Like
2

What’s returning the forbidden error? Is it attempting to validate a token or is a request to Okta failing?

3

I’m assuming it’s the token validation part that fails as I can see the login attempt in the console and its marked as successful.

4

If local token validation is occurring, its likely because you are using the Org Authorization Server to mint tokens. More information about this limitation here: Signature Validation Failed on Access Token | Okta Help Center