After update to 20.0.0: Fetching from User Info endpoint returns 403 #15331

jonasschwab · 2022-11-03T16:09:06Z

jonasschwab
Nov 3, 2022

I'm using Keycloak to secure a JupyterHub set up accroding to the Zero to Jupyter tutorial here. The settings for authentication are specified here:

hub:
  config:
    GenericOAuthenticator:
      client_id: your-client-id
      client_secret: your-client-secret
      oauth_callback_url: https://your-jupyterhub-domain/hub/oauth_callback
      authorize_url: https://${host}/auth/realms/${realm}/protocol/openid-connect/auth
      token_url: https://${host}/auth/realms/${realm}/protocol/openid-connect/token
      userdata_url: https://${host}/auth/realms/${realm}/protocol/openid-connect/userinfo
      login_service: keycloak
      username_key: preferred_username
      userdata_params:
        state: state
    JupyterHub:
      authenticator_class: generic-oauth

This worked like a charm with version 19.0.3 and earlier, but with version 20 the hub complains

Error fetching user data 403 GET https:/${host}/auth/realms/${realm}/protocol/openid-connect/userinfo

and KeyCloak logs

WARN  [org.keycloak.events] (executor-thread-12) type=USER_INFO_REQUEST_ERROR, realmId=<redacted>, clientId=null, userId=null, ipAddress=<redacted>, error=access_denied, auth_method=validate_access_token

I was wondering if there's an obvious reason why it doesn't work any more.

anowak-ct · 2022-11-03T22:45:29Z

anowak-ct
Nov 3, 2022

I am having a similar problem with requesting openid-connect/userinfo after upgrading from v19.0.3 to v20.0.0. I am also getting 403 error.

In my scenario I am using a OAuth 2.0 Device Authorization Grant workflow:

Request 8-letter used_code and verification url

POST /realms/{realm}/protocol/openid-connect/auth/device

(body contains client_id, client_secrent and "scope": "offline_access")

Use 8000 r opens verification URL, enters user_code provided by response in any browser, authenticates and confirms requested scopes ("offline_access, User Profile, Email Address")
Exchange device_code for tokens:

POST /realms/{realm}/protocol/openid-connect/token

(body: client_id, client_secret, grant_type, device_code and scope=offline_token)
Response contains usual bearer tokens, incl. access and refresh, the scope returned is "offline_access profile email"

Using the bearer access token from the previous response, request userinfo:

GET /realms/{realm}/protocol/openid-connect/userinfo

--> This results 403 error response with the following message in the header:

Bearer realm="{realm}", error="insufficient_scope", error_description="Missing openid scope"

Again, this used to work perfectly with v19.0.3 and older versions.
Do I have to configure something in Realm/Client roles? I tried a few things, but no luck. I thought that openid scope would be included by default...

3 replies

toddkazakov Nov 7, 2022

Did you try adding openid to the list of requested scopes?

anowak-ct Nov 7, 2022

@toddkazakov
Yes, I did try. But there are 2 problems with that:

All clients would need to be updated because of code change.
Even with openid in the scope, I can not use a refreshed access_token. Even if add openid to the scope. The access_token from the "device_code to tokens" endpoint works fine (grant_type=urn:ietf:params:oauth:grant-type:device_code), but with grant_type=refresh_token, I am getting 403 from the userinfo call
Looks like there is a breaking change with v20.
The current workaround is to use to decode the JWT access_token, which hold all userinfo I need. In hindsight, using JWT would have been the better option, but hey, ....

jonasschwab Nov 8, 2022
Author

Thank you, worked for me: Adding

scope:
  - openid

to GenericOAuthenticator

Navigation Menu

Repository navigation

After update to 20.0.0: Fetching from User Info endpoint returns 403 #15331

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

After update to 20.0.0: Fetching from User Info endpoint returns 403 #15331

Uh oh!

jonasschwab Nov 3, 2022

Replies: 1 comment · 3 replies

Uh oh!

Uh oh!

anowak-ct Nov 3, 2022

Uh oh!

Uh oh!

toddkazakov Nov 7, 2022

Uh oh!

Uh oh!

anowak-ct Nov 7, 2022

Uh oh!

jonasschwab Nov 8, 2022 Author

jonasschwab
Nov 3, 2022

Replies: 1 comment 3 replies

anowak-ct
Nov 3, 2022

jonasschwab Nov 8, 2022
Author