Hi, I deployed ST on https://mobilitycare.fr I need to implement a custom OIDC provider. I use the ThirdParty provider. The provider returns the access_token correctly but when I do the https://auth.mobilitycare.fr/auth/signinup POST with body : { "code": "", "thirdPartyId": "ordoclic", "redirectURI": "https://mobilitycare.fr/auth/callback/ordoclic" } I get this error : Error: Request failed with status code 401 at createError (/home/ec2-user/mc-auth/node_modules/axios/lib/core/createError.js:16:15) at settle (/home/ec2-user/mc-auth/node_modules/axios/lib/core/settle.js:17:12) at IncomingMessage.handleStreamEnd (/home/ec2-user/mc-auth/node_modules/axios/lib/adapters/http.js:269:11) at IncomingMessage.emit (node:events:525:35) at endReadableNT (node:internal/streams/readable:1358:12) at processTicksAndRejections (node:internal/process/task_queues:83:21)

this usually happens if you have misconifigured something on the provider's side - like a bad scope, or bad redirect uri

Do you mean the provider configuration on backend ?

Yes. Or on the provider dashboard.

Hi, How can I send the accessToken request with the Basic Authorization header on the custom provider please ? Thank you

You need to provide the getUserProfile function as mentioned in the docs.

Not in this function, in the accessTokenAPI POST call on https://oauth.example.com/token endpoint Thank you

im not sure what you mean

I have this error data: { error: 'invalid_client', error_description: "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_basic', but method 'client_secret_post' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_post'." } When doing this POST request to get the accessToken : https:///oauth2/token client_id=&client_secret=&grant_type=authorization_code&code=&redirect_uri= So this error happens before making the getUserProfileInfo request and I just need to set the Authorization header to and I don't know how. Thank you

ah i see. Can i see how you have implemented the custom provider? Share some code please.

ThirdPartyPasswordless.init({ flowType: "USER_INPUT_CODE", contactMethod: "EMAIL_OR_PHONE", providers: [ { id: "ordoclic", get: (redirectURI, authCodeFromRequest) => { let accessTokenAPIParams: { [key: string]: string } = { client_id: , client_secret: , grant_type: "authorization_code", }; if (authCodeFromRequest !== undefined) { accessTokenAPIParams.code = authCodeFromRequest; } if (redirectURI !== undefined) { accessTokenAPIParams.redirect_uri = redirectURI; } async function getProfileInfo(accessTokenAPIResponse: any) { // TODO: get user info from Ordoclic API return { id: "userID", email: { id: "email@email.com", isVerified: true, }, }; } return { accessTokenAPI: { url: "", params: accessTokenAPIParams }, authorisationRedirect: { url: "", params: { client_id: clientId, scopes: "openid offline_access", response_type: "code", }, }, getClientId: () => { return clientId; }, getProfileInfo, getRedirectURI: () => { return "" } }; }, } ], }),

You need to fill in the right values for all the string with “”

Yes I know I put the <> on purpose, do you need these values to test ?

Perhaps @sattvikc can help here

hi, couple of things here. Regarding accessToken, aren't you supposed to post all the info as a form post data as opposed to query params? Also I see that you have mentions a CORS issue, is it being reported from the provider or the cors plugin in your backend app?

Hi, The CORS issue is reported on the frontend callback after running thirdPartySignInAndUp() I get this message { status : 500, statusText: "", type : "cors", url : "https://auth.mobilitycare.fr/auth/signinup" } For the accessToken, I don't know how to put the parameters in the form post into the ST config.

CORS settings will need to be addressed first I guess, before fixing the custom provider, would you be able to verify your settings to ensure that ?

I don’t understand where it’s coming from because I use the passwordless and Google authentication and it works fine.

im confused, google auth works fine? So then calling

thirdPartySignInAndUp

works fine?

Yes it's just when I use the custom provider when we need to make the accessToken request to the provider I need to configure the client and secret ids with 'Basic' format

Okay. Will wait for @sattvikc to help

hey @wtx7777, let me know a good time we can debug this over a call

Hi @sattvikc when are you available ?

generally 11 am to 5pm IST

Hi @sattvikc, how are you ? I managed to make everything work with your solution so I want to thank you 👍

that's good to know, happy to help 😀