Onelogin and ID Token : grant request is invalid

3
votes

I am using connect id to deal with rstudio login. After retreiving the code The API returns an error:{"error":"invalid_grant","error_description":"grant request is invalid"} and i have no idea why:

$ch=curl_init();
$header = array('Authorization: Basic '.base64_encode($client_id.':'.$secret), 'Content-Type: application/x-www-form-urlencoded');
$post = array('grant_type' => 'authorization_code',
'code' => $code,
'redirect_uri' => 'MY_URL');
$url = "https://eif-til.onelogin.com/oidc/token";
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));
$result = curl_exec($ch);

All the variables entered seems fine, the authorisation code received seems fine and is passed as is. On Onelogin side everything seems configured as it should. My suspicion is on the PHP Curl code but I don't know what is missing/wrong

2
phpapicurltokenonelogin

2 Answers

0
votes

Your Content-Type header is not correct: 

$header = array('Authorization: Basic '.base64_encode($client_id.':'.$secret), 'Content-Type=application/x-www-form-urlencoded');

should read:

$header = array('Authorization: Basic '.base64_encode($client_id.':'.$secret), 'Content-Type: application/x-www-form-urlencoded');

i.e. with a "colon" rather than a "=" between name and value.

0
votes

You can also receive a "grant request is invalid" response if you're using PKCE and either miss out the code_verifier parameter or it is incorrect (this includes cases where the code_challenge was generated incorrectly in the previous step).