Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-8604

3scale SSO callback URL is being reused with an expired code in the URL

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 2.12.0 GA
    • System
    • False
    • None
    • False
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Hide
      1. The attribute Email Verified disabled for the user in RH-SSO try to login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the first time (the URL must be "https://<ADMIN_PORTAL_URL>/p/sessions/new"). When entering the user RH-SSO credentials it must returns the error Your account isn't active or hasn't been approved yet.. The URL content will be something like:

        https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=7afed289-29d2-4eeb-bdce-3c04bdf72481.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

      2. Try to login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the second time and the page will be refreshed showing the error The code is incorrect or expired.. The URL content will be something like:

        https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=ee4e3937-6517-4bcc-a687-9f607692e78c.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

      Show
      The attribute Email Verified disabled for the user in RH-SSO try to login into Admin Portal using RH-SSO ( Authenticate through <> Red Hat Single Sign-On ) for the first time (the URL must be " https://<ADMIN_PORTAL_URL>/p/sessions/new "). When entering the user RH-SSO credentials it must returns the error Your account isn't active or hasn't been approved yet. . The URL content will be something like: https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=7afed289-29d2-4eeb-bdce-3c04bdf72481.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5 Try to login into Admin Portal using RH-SSO ( Authenticate through <> Red Hat Single Sign-On ) for the second time and the page will be refreshed showing the error The code is incorrect or expired. . The URL content will be something like: https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=ee4e3937-6517-4bcc-a687-9f607692e78c.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

      When a RH-SSO new user with Email Verified attribute disabled authenticate into Admin Portal, it get the message that the account isn't active or approved yet. If he tries to authenticate again, it gets a code incorrect or expired.

       

      Workaround:

      1. Enable the Email Verified attribute for the user in RH-SSO
      2. login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the first time (the URL must be "https://<ADMIN_PORTAL_URL>/p/sessions/new")

              rhn-support-eazevedo Ernani Azevedo
              rhn-support-eazevedo Ernani Azevedo
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: