0

I have the following Spring Security configuration:

spring:
  security:
    oauth2:
      client:
        registration:
          huawei:
            client_id: blablabla
            client-secret: blablabla
            redirect-uri: 'http://localhost:8080/login/oauth2/code/huawei'
            scope: openid
        huawei:
          authorization-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/authorize
          token-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/token
          user-info-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/userinfo
          user-name-attribute: login

Same configurations works well with a big number of different OAuth Providers, and I see that Spring sends proper request to Huawei OAuth Provider:

20:27:23.497 [parallel-5] DEBUG o.s.s.w.s.DefaultServerRedirectStrategy - Redirecting to 'https://oauth-login.cloud.huawei.com/oauth2/v3/authorize?response_type=code&client_id=<MY ID HERE>&scope=openid&state=<...>&redirect_uri=http://localhost:8080/login/oauth2/code/huawei&nonce=<...>'

But Spring receives an erroneous response:

[{sub_error=20001, error_description=missing required parameter: client_id, error=1102}]

Short answer is here for a custom OAuth client and is related to the thing that clientId is expected in x-www-form-urlencoded, but the question still remains: how to change my Spring Security configuration to make it work?

Andrew Kuleshov
  • 188
  • 9
  • 1
    Shouldn't it be `client-id` and not `client_id` in your yaml file? – ch4mp Jul 17 '23 at 23:00
  • Yes this was also my first guess, but did not work as well unfortunately – Andrew Kuleshov Jul 18 '23 at 12:34
  • [This documentation page](https://developer.huawei.com/consumer/en/doc/development/HMSCore-References/server-error-codes-0000001062371380) makes me think that the `1102` `20001` error you get is not related to the authorization-code request you trace (which contains a `client_id` parameter). Maybe the token request after the authorization-code is returned? You should trace this request to check (it is not going through your browser, don't look for it there, it is an exchange between Spring client and authorization server). – ch4mp Jul 18 '23 at 17:27

0 Answers0