Django-oauth-toolkit: AccessDenied with requests_oauthlib

[bryanveloso]

I've been following the tutorial to try and get an SSO working for my project and I've been able to use the provider against the Heroku test app. Outside of that though, I've had no luck getting things working as I consistently get AccessDenied errors thrown.

I'm using requests_oauthlib to try and get through the authentication process and I'm not sure what to try anymore. I've tried putting client_id and client_secret in the response body as well as the auth= parameter shown below (the second method found mentioned here, https://groups.google.com/forum/#!topic/django-oauth-toolkit/KsDyKtrhhVg).

For clarity, the Application is a public, authorization-code application.

>>> from django.conf import settings
>>> client_id = settings.CLIENT_ID
>>> client_secret = settings.CLIENT_SECRET
>>> authorization_base_url = 'https://localhost:8443/authorize/'
>>> token_url = 'https://localhost:8443/token/'
>>> redirect_uri = 'https://localhost:8444/accounts/authenticated/'
>>> from requests_oauthlib import OAuth2Session
>>> base = OAuth2Session(client_id)
>>> authorization_url, state = base.authorization_url(authorization_base_url)
>>> print authorization_url
https://localhost:8443/authorize/?response_type=code&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju&state=RW0SLFm9SgllPrm01aZGDkaeZigUTu
>>> authorization_response = 'https://localhost:8444/accounts/authenticated/?state=RW0SLFm9SgllPrm01aZGDkaeZigUTu&code=rqoG2aZ5NrXYEj4xbeobxb3RjBirN7'
>>> token = base.fetch_token(token_url, authorization_response=authorization_response, auth=(client_id, client_secret))
Traceback (most recent call last):
  File "<input>", line 1, in <module>
  File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/requests_oauthlib/oauth2_session.py", line 144, in fetch_token
    self._client.parse_request_body_response(r.text, scope=self.scope)
  File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/clients/web_application.py", line 271, in parse_request_body_response
    self.token = parse_token_response(body, scope=scope)
  File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 297, in parse_token_response
    validate_token_parameters(params, scope)
  File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 304, in validate_token_parameters
    raise_from_error(params.get('error'), params)
  File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/errors.py", line 223, in raise_from_error
    raise cls(**kwargs)
AccessDeniedError
>>> 

[ib-lundgren]

The issue might be with requests-oauthlib not forwarding the auth parameter
correctly. This is fixed in master but uncertain if its on pypi. Please
install from github and if it fails enable the 'oauthlib' logger on both
client and server and post output.
On Sep 15, 2013 11:25 PM, "Bryan Veloso" [email protected] wrote:

I've been following the tutorial to try and get an SSO working for my
project and I've been able to use the provider against the Heroku test app.
Outside of that though, I've had no luck getting things working as I
consistently get AccessDenied errors thrown.

I'm using requests_oauthlib to try and get through the authentication
process and I'm not sure what to try anymore. I've tried putting client_idand
client_secret in the response body as well as the auth= parameter shown
below.

For clarity, the Application is a public, authorization-code application.

from django.conf import settings
client_id = settings.CLIENT_ID
client_secret = settings.CLIENT_SECRET
authorization_base_url = 'https://localhost:8443/authorize/'
token_url = 'https://localhost:8443/token/'
redirect_uri = 'https://localhost:8444/accounts/authenticated/'
from requests_oauthlib import OAuth2Session
base = OAuth2Session(client_id)
authorization_url, state = base.authorization_url(authorization_base_url)
print authorization_urlhttps://localhost:8443/authorize/?response_type=code&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju&state=RW0SLFm9SgllPrm01aZGDkaeZigUTu
authorization_response = 'https://localhost:8444/accounts/authenticated/?state=RW0SLFm9SgllPrm01aZGDkaeZigUTu&code=rqoG2aZ5NrXYEj4xbeobxb3RjBirN7'
token = base.fetch_token(token_url, authorization_response=authorization_response, auth=(client_id, client_secret))
Traceback (most recent call last):
File "", line 1, in
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/requests_oauthlib/oauth2_session.py", line 144, in fetch_token
self._client.parse_request_body_response(r.text, scope=self.scope)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/clients/web_application.py", line 271, in parse_request_body_response
self.token = parse_token_response(body, scope=scope)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 297, in parse_token_response
validate_token_parameters(params, scope)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 304, in validate_token_parameters
raise_from_error(params.get('error'), params)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/errors.py", line 223, in raise_from_error
raise cls(**kwargs)
AccessDeniedError

—
Reply to this email directly or view it on GitHubhttps://github.com/evonove/django-oauth-toolkit/issues/58
.

[bryanveloso]

@ib-lundgren — Thanks for chiming in. Doesn't look like that's the case. Here are the local variables for the parse_request_body_response call:

username: None
body: u'grant_type=authorization_code&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju'
code: '7gnKfGk0LnLJhJiv5AkLi5klm9st2k'
authorization_response: 'https://localhost:8444/accounts/authenticated/?state=w0BCerw15f1nsXqETKvG5jJXw4kRmT&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k'
self: <requests_oauthlib.oauth2_session.OAuth2Session object at 0x106ca0f10>
token_url: 'https://localhost:8443/token/'
auth: ('c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju', '5p.068TAdREHVoj4p_RlVRwUDP=or@BnMixAVVTU@gBZF8=zzRtBbHbGxS1=j?spTR58Fu7ms5@[email protected]_C3475l4;:UiAdrQu')
r: <Response [400]>
kwargs: {}
password: None

Here are the logs:

17:03:46 https.1   | Generated new state w0BCerw15f1nsXqETKvG5jJXw4kRmT.
17:03:46 https.1   | [16/Sep/2013 00:03:46] "GET /accounts/authorize/ HTTP/1.1" 200 46720 (time: 0.13s; sql: 0ms (0q))
17:03:52 https.1   | Requesting url https://localhost:8443/token/ using method POST.
17:03:52 https.1   | Supplying headers {u'Accept': u'application/json'} and data {u'code': u'7gnKfGk0LnLJhJiv5AkLi5klm9st2k', u'grant_type': u'authorization_code', u'client_id': u'c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju'}
17:03:52 https.1   | Passing through key word arguments {'auth': ('c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju', '5p.068TAdREHVoj4p_RlVRwUDP=or@BnMixAVVTU@gBZF8=zzRtBbHbGxS1=j?spTR58Fu7ms5@[email protected]_C3475l4;:UiAdrQu')}.
17:03:52 https.1   | Prepared fetch token request body grant_type=authorization_code&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju
17:03:52 https.1   | Request to fetch token completed with status 400.
17:03:52 https.1   | Response headers were CaseInsensitiveDict({'server': 'WSGIServer/0.1 Python/2.7.5', 'pragma': 'no-cache', 'cache-control': 'no-store', 'date': 'Mon, 16 Sep 2013 00:03:52 GMT', 'x-frame-options': 'SAMEORIGIN', 'content-type': 'application/json;charset=UTF-8'}) and content {"error": "access_denied"}.
17:03:52 https.1   | Invoking 0 token response hooks.

[ib-lundgren]

Ah yea, access_denied. That error name is almost certainly not what it
should be and needs to be fixed in oauthlib at some point. This error only
occurs when confirming whether the redirect_uri passed in for authorization
matches the one supplied when fetching the access token. Since DOT requires
a redirect_url to be specified during client/app registration including a
redirect_uri during auth/token is not strictly necessary. However it seems
that DOT requires it.

Following the tutorial gives me the same error as you get, change

base = OAuth2Session(client_id)

to

base = OAuth2Session(client_id, redirect_uri='whatever you typed in the
registration, i used http://127.0.0.1/callback')

Also if you are debugging against non-https like I did, export DEBUG=1 to
disable https checks.

On Mon, Sep 16, 2013 at 1:07 AM, Bryan Veloso [email protected]:

@ib-lundgren https://github.com/ib-lundgren — Thanks for chiming in.
Doesn't look like that's the case. Here are the local variables for the
parse_request_body_response call:

username: None
body: u'grant_type=authorization_code&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju'
code: '7gnKfGk0LnLJhJiv5AkLi5klm9st2k'
authorization_response: 'https://localhost:8444/accounts/authenticated/?state=w0BCerw15f1nsXqETKvG5jJXw4kRmT&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k'
self:
token_url: 'https://localhost:8443/token/'
auth: ('c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju', '5p.068TAdREHVoj4p_RlVRwUDP=or@BnMixAVVTU@gBZF8=zzRtBbHbGxS1=j?spTR58Fu7ms5@[email protected]_C3475l4;:UiAdrQu')
r: kwargs: {}
password: None

Here are the logs:

17:03:46 https.1 | Generated new state w0BCerw15f1nsXqETKvG5jJXw4kRmT.
17:03:46 https.1 | [16/Sep/2013 00:03:46] "GET /accounts/authorize/ HTTP/1.1" 200 46720 (time: 0.13s; sql: 0ms (0q))
17:03:52 https.1 | Requesting url https://localhost:8443/token/ using method POST.
17:03:52 https.1 | Supplying headers {u'Accept': u'application/json'} and data {u'code': u'7gnKfGk0LnLJhJiv5AkLi5klm9st2k', u'grant_type': u'authorization_code', u'client_id': u'c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju'}
17:03:52 https.1 | Passing through key word arguments {'auth': ('c4Jev7re0fLCmeWs=cmJ=XhXKrVA6f@TyGaMUqju', '5p.068TAdREHVoj4p_RlVRwUDP=or@BnMixAVVTU@gBZF8=zzRtBbHbGxS1=j?spTR58Fu7ms5@[email protected]_C3475l4;:UiAdrQu')}.
17:03:52 https.1 | Prepared fetch token request body grant_type=authorization_code&code=7gnKfGk0LnLJhJiv5AkLi5klm9st2k&client_id=c4Jev7re0fLCmeWs%3DcmJ%3DXhXKrVA6f%40TyGaMUqju
17:03:52 https.1 | Request to fetch token completed with status 400.
17:03:52 https.1 | Response headers were CaseInsensitiveDict({'server': 'WSGIServer/0.1 Python/2.7.5', 'pragma': 'no-cache', 'cache-control': 'no-store', 'date': 'Mon, 16 Sep 2013 00:03:52 GMT', 'x-frame-options': 'SAMEORIGIN', 'content-type': 'application/json;charset=UTF-8'}) and content {"error": "access_denied"}.
17:03:52 https.1 | Invoking 0 token response hooks.

—
Reply to this email directly or view it on GitHubhttps://github.com/evonove/django-oauth-toolkit/issues/58#issuecomment-24483635
.

[synasius]

I can confirm that redirect_uri is ALWAYS required by DOT when you exchange the code for the token.

[bryanveloso]

It looks like that missing redirect_uri was the problem. Thanks gents! :metal:

[chrisportela]

To any poor soul who also reaches this problem: It's your redirect_uri. Check the http vs https. Check the domain. Does it have the forward slash or not? etc.

Solved my problem.