Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-8604

3scale SSO callback URL is being reused with an expired code in the URL

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • None
    • 2.12.0 GA
    • System
    • False
    • None
    • False
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Hide
      1. The attribute Email Verified disabled for the user in RH-SSO try to login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the first time (the URL must be "https://<ADMIN_PORTAL_URL>/p/sessions/new"). When entering the user RH-SSO credentials it must returns the error Your account isn't active or hasn't been approved yet.. The URL content will be something like:

        https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=7afed289-29d2-4eeb-bdce-3c04bdf72481.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

      2. Try to login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the second time and the page will be refreshed showing the error The code is incorrect or expired.. The URL content will be something like:

        https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=ee4e3937-6517-4bcc-a687-9f607692e78c.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

      Show
      The attribute Email Verified disabled for the user in RH-SSO try to login into Admin Portal using RH-SSO ( Authenticate through <> Red Hat Single Sign-On ) for the first time (the URL must be " https://<ADMIN_PORTAL_URL>/p/sessions/new "). When entering the user RH-SSO credentials it must returns the error Your account isn't active or hasn't been approved yet. . The URL content will be something like: https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=7afed289-29d2-4eeb-bdce-3c04bdf72481.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5 Try to login into Admin Portal using RH-SSO ( Authenticate through <> Red Hat Single Sign-On ) for the second time and the page will be refreshed showing the error The code is incorrect or expired. . The URL content will be something like: https://<ADMIN_PORTAL_URL>/auth/keycloak_807ec359d602/callback?session_state=592ecf35-2081-4635-a1a7-85972b083d74&session_state=592ecf35-2081-4635-a1a7-85972b083d74&code=ee4e3937-6517-4bcc-a687-9f607692e78c.592ecf35-2081-4635-a1a7-85972b083d74.2ac64915-2059-4cc0-8fce-dfc2add95ca5

    Description

      When a RH-SSO new user with Email Verified attribute disabled authenticate into Admin Portal, it get the message that the account isn't active or approved yet. If he tries to authenticate again, it gets a code incorrect or expired.

       

      Workaround:

      1. Enable the Email Verified attribute for the user in RH-SSO
      2. login into Admin Portal using RH-SSO (Authenticate through <> Red Hat Single Sign-On) for the first time (the URL must be "https://<ADMIN_PORTAL_URL>/p/sessions/new")

      Attachments

        Activity

          People

            rhn-support-eazevedo Ernani Azevedo
            rhn-support-eazevedo Ernani Azevedo
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: