IdentityServer4 Invalid authorization code{“code”:

Question

I am getting Invalid authorization code{"code": "MyTestCode"},

Here is more detailed error: Invalid authorization code{"code": "MyTestCode"}, details: {"ClientId": "AuthorizationCodeClientFlow", "ClientName": "Authorization Code Client", "GrantType": "authorization_code", "Scopes": null, "AuthorizationCode": "MyTestCode", "RefreshToken": null, "UserName": null, "AuthenticationContextReferenceClasses": null, "Tenant": null, "IdP": null, "Raw": {"grant_type": "authorization_code", "code": "MyTestCode", "redirect_uri": "https://localhost:5000/oauth/callback", "client_id": "AuthorizationCodeClientFlow"}, "$type": "TokenRequestValidationLog"} <s:IdentityServer4.Validation.TokenRequestValidator>

I am testing using Postman

This is client generated from this code :

            {
                ClientName = "Authorization Code Client",
                ClientId = "AuthorizationCodeClientFlow",
                AllowedGrantTypes = GrantTypes.Code,
                ClientSecrets =
                  {
                    new Secret("AuthorizationCodeClientFlowSecret".Sha512())
                  },
                AllowedScopes =
                  {
                    "all"
                  },
                RedirectUris =
                  new List<string> {
                       "https://localhost:5000/oauth/callback"
                  },
                AllowOfflineAccess = false,
                AccessTokenLifetime = 60
            };

https://localhost:5105/oauth/authorize works fine. I get error in https://localhost:5105/oauth/token step. When I validate request like that:

var form = (await _httpContextAccessor.HttpContext.Request.ReadFormAsync()).AsNameValueCollection();

            var validationResult = await _requestValidator.ValidateRequestAsync(form, clientResult);

            if (validationResult.IsError)
            {
                return new IdpTokenResponse
                {
                    Custom = new Dictionary<string, object>
                      {
                        { "Error", validationResult.Error },
                        { "ErrorDescription", validationResult.ErrorDescription }
                      }
                };
            }

Tore Nestenius Tore Nestenius · Accepted Answer · 2020-09-14T11:49:37

You need to take the authorization code that you receive from the initial authentication request and then take it and pass it along when you get the token from the token endpoint.

one unrelated thing is that you should always ask for the openid scope when you authenticate against IdentityServer, All or "" is not valid.

IdentityServer4 Invalid authorization code{“code”:

1 Answers