Layer7 API Management

Usernames having '+' symbol are failing while trying OAuth Authentication retrieving access_token.

OTK verision -4.1

Grant type - Password

Sample User name- "myuser+_12_43@maildomain.cc" 

Authentication failure Error message below.

Please share details regarding fix/workaround for the above scenario.

Hi Vijay,

How was this user created, LDAP, Internal IDP, etc? I noticed with the internal IDP it prevents a user from being created with the + symbol as part of the user name. The error "Contains characters that interfere with automatic certificate management" is thrown.

Regards,

Joe

Hi Joe,

Thank you for your response.

The user was created in eDirectory Identity provider. We are sending an access token request (Password grant type) and facing the failure as mentioned earlier while generating the token.

Fyi- this user was successfully authenticated against the directory.

Also, the error message "The resource owner could not be authenticated due to missing or invalid credentials" describes missing or invalid credentials.

Could you please provide on what cases we receive invalid credentials error. Also what are the valid cases during which the Token gets generated successfully.

Thank you.

Vijay. 

Thank you for clarifying. The error is usually the result of one of the below:

1. The username or password is incorrect
2. You are not authenticating against the correct identity provider.
3. Your account has been disabled/locked out

Do you see any errors in the SSG log on the Gateway when authenticating this user?

Is this user able to login to policy manager?

Just to confirm OTK is working correctly, can you test with a resource owner that does not have a "+" as part of the user name? The expect response will be an access token:

i.e:

{   "access_token":"ffe4a4ea7-3aa4-442b-bb75-eae3721ab183",   "token_type":"Bearer",   "expires_in":3600,   "scope":"oob" }

Regards,
Joe

Thank you again Joe. Please see the answers below.

Do you see any errors in the SSG log on the Gateway when authenticating this user?

Below is the log message we see in the Policy Manager.

"Failed 401- Retrieve access_token"

Is this user able to login to policy manager?

We are not sure if the user has gateway access role provisioned to access the Policy manager.

OTK is working fine for users who do not have a "+" symbol on the name.

Regards,

Vijay.

We had to handle the issue by translating the ASCII value of '+' symbol and storing in the OTK database.

Not sure if that is the right approach. Please let us know if you have any thoughts on this or alternate approaches if any.

Thank you.

Vijay.