Troubleshooting: OAuth and OpenID Connect Error Codes

Version Affected: All

 

Overview

This article lists the common errors returned by SecureAuth's OAuth and OpenID Connect (OIDC) endpoints, and what each one means. Some errors are self-explanatory; others are less so. 

oidctoken.aspx Errors

• invalid_scope (all grant types): the request asked for a scope that doesn't exist.
• invalid_request, described as "Missing Client secret" (all grant types): the Client Secret is missing from the request.
• invalid_request, described as "Missing Client ID." (all grant types): the Client ID is missing from the request.
• access_denied, described as "Request is unauthorized" (all grant types): the Client ID or Client Secret is wrong.
• invalid_grant, described as "Missing or invalid grant_type." (all grant types): the grant_type parameter is missing, invalid, or not allowed for this realm.
• server_error, described as "Unexpected error" (Resource Owner Password Credentials grant only): the username does not exist.
• invalid_grant (Resource Owner Password Credentials grant only): the user exists, but the password is wrong.

oidcauthorize.aspx Errors

• "Redirect URI is unsafe" (Authorization Code, Hybrid, and Implicit grants): the redirect URL uses http instead of https, or has not been added to the realm's allowed redirect URI list.
• "Invalid Client_ID" (Authorization Code, Hybrid, and Implicit grants): the Client ID is wrong.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.