React-native-app-auth: client_id is not passed in the token exchange request

[palashjhabak]

Issue

client_id id is not passed to the token end point along with other parameters and due of which the token exchange request is failing.

---

Environment

• Frappe: e.g. IdentityServer 4 / Okta / Azure
• Platform that you're experiencing the issue on:
  
  
  
  • [ ] iOS
  
  
  • [x] Android
  
  
  • [ ] iOS but have not tested behavior on Android
  
  
  • [ ] Android but have not tested behavior on iOS
  
  
  • [ ] Both
  
  
• Are you using Expo, e.g. ExpoKit?
  
  
  
  • [x] No
  
  
  • [ ] Yes, I've _not_ ejected
  
  
  • [ ] Yes, but I have ejected to ExpoKit
  
  
  • [ ] Yes, but I have ejected to vanilla React Native
  
  

[kadikraman]

Hi. Which IDP are you using? It _should_ be added to the token request, but you could try also adding it to additionalParameters to check.

[fgagno]

Hi. @kadikraman, I had the same problem with my rails app and Google sign-in, so I tried to add it to additionalParameters, and now it's passed.
I shouldn't need to do so, but it works.
Thanks.

[bhaskardabhi-oviyum]

I tried adding in additionalParameters. It didn't work for me.

config = {
    clientId: "{clientId}",
    clientSecret: "{clientSecret}",
    redirectUrl: "{redirectUrl}",
    serviceConfiguration: {
      authorizationEndpoint: "https://www.strava.com/oauth/mobile/authorize",
      tokenEndpoint: "https://www.strava.com/oauth/token",
      revocationEndpoint: "https://www.strava.com/oauth/deauthorize"
    },
    additionalParameters: {
      approval_prompt: "force",
      grant_type: "authorization_code",
      client_id: "{client_id}",
      client_secret: "{clientSecret}"
    },
    scopes: ["activity:read"]
  }

Let me know if I am doing something wrong here.

[kadikraman]

grant_type, client_id and client_secret should all be passed in by the library, since you added them to the config. There should be no need to add them manually. You could try a breakpoint here to inspect the request, and here to inspect the underlying error.

[bhaskardabhi-oviyum]

I debugged the internal code. I need to pass client_id & client_secret in the request for Token exchange.

As I am passing clientId & clientSecret, so it going into this condition and doesn't send client id which is required by my provider.

So I thought I won't pass clientSecret and will mention it as additionalParameters.

So I removed clientSecret and only sending clientId and pass client_secret as an additional parameter so that this code will be executed and client id will be passed. As client_secret is mentioned in an additional parameter so it will be passed also. But that didn't work as well.

Because this code is passing nil as the parameter instead of the actual additional parameter.

I am sure I am doing something stupid. Not sure what is the best way to pass client_id & client_secret as part of the url parameter in token exchange request.

[kadikraman]

Thanks for investigating! We're using the convenience method authStateByPresentingAuthorizationRequest to do the token exchange based on the auth response and it looks like it does not allow customising the url parameters, so supporting this would require a native change on the iOS side.

[r0b0t3d]

I can make it works finally.
You can pass your client_id & client_secret to tokenEndpoint config.

const config: AuthConfiguration = {
    serviceConfiguration: {
      authorizationEndpoint: 'https://www.strava.com/oauth/mobile/authorize',
      tokenEndpoint: 'https://www.strava.com/oauth/token?client_id=<your_client_id>&client_secret=<your_client_secret>',
      revocationEndpoint: 'https://www.strava.com/oauth/deauthorize'
    },
}

[cavator]

ok @r0b0t3d this worked, but with my callback with is a "" literary is just a empty php file, i have no idea what and HOW redirect back to the app, i already change all need configs, i just don't know how callback

[r0b0t3d]

@cavator If you are working with Strava. You have to config Authorization Callback Domain. Let's say you set foo.com
Then you can pass it to redirectUrl like this

const config: AuthConfiguration = {
    serviceConfiguration: {
      authorizationEndpoint: 'https://www.strava.com/oauth/mobile/authorize',
      tokenEndpoint: 'https://www.strava.com/oauth/token?client_id=<your_client_id>&client_secret=<your_client_secret>',
      revocationEndpoint: 'https://www.strava.com/oauth/deauthorize'
    },
    redirectUrl: 'yourapp://foo.com'
}