Getting Http 500 when calling api to set bcAuthnToken=true for authorizationRequestCustomAllowedParameters

[dhanan-np]

Hello there,
I am running a curl with appropriate token to enable bcAuthnToken

curl --location --request PATCH 'https://my-dummy-host.com/jans-config-api/api/v1/jans-auth-server/config' \
--header 'Authorization: Bearer dummy-token-with-scope[https://jans.io/oauth/jans-auth-server/config/properties.write]' \
--header 'Content-Type: application/json-patch+json' \
--header 'Cookie: org.gluu.i18n.Locale=en' \
--data '[
    {
        "op": "add",
        "path": "authorizationRequestCustomAllowedParameters",
        "value": {
            "paramName": "bcAuthnToken",
            "returnInResponse": true
        }
    }
]'

I am getting http-500 and in table jansAppConf, the value of the column jansConfDyn is not updated.
I am not getting any error trace in tog. I have checked the following logs-

1. configapi.log
2. configapi_persistence.log
3. configapi_script.log

I see no trace of error in these files. Please help me in the situation. We can connect over the call if needed.

[ossdhaval]

Hi @imShakil, Have you observed the same behavior? Can you confirm?

[dhanan-np]

Hello @ossdhaval ,

Today I was again doing some test and found this in the log. Hoping that this should help in identifying the issue

15-05 10:09:43.572 INFO  [qtp762476028-14] jans.configapi.filters.LoggingFilter LoggingFilter.java:33- ****Request PATCH /jans-auth-server/config from IP 41.133.111.141
15-05 10:09:43.572 INFO  [qtp762476028-14] jans.configapi.filters.LoggingFilter LoggingFilter.java:33- ****Request PATCH /jans-auth-server/config from IP 41.133.111.141
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:139- AuditLogInterceptor::getAuditHeaderAttributes() - auditLogConf:AuditLogConf [enabled=true, ignoreHttpMethod=[], headerAttributes=[User-inum]], httpHeaders:org.jboss.resteasy.specimpl.ResteasyHttpHeaders@7e0a191b
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:139- AuditLogInterceptor::getAuditHeaderAttributes() - auditLogConf:AuditLogConf [enabled=true, ignoreHttpMethod=[], headerAttributes=[User-inum]], httpHeaders:org.jboss.resteasy.specimpl.ResteasyHttpHeaders@7e0a191b
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:145- AuditLogInterceptor::getAuditHeaderAttributes() - attributes:[User-inum]
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:145- AuditLogInterceptor::getAuditHeaderAttributes() - attributes:[User-inum]
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:157- AuditLogInterceptor::getAuditHeaderAttributes() - attributeMap:{User-inum=null}
15-05 10:09:43.574 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:157- AuditLogInterceptor::getAuditHeaderAttributes() - attributeMap:{User-inum=null}
15-05 10:09:43.575 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:87- Process Audit Log Interceptor - context:NonTerminalAroundInvokeInvocationContext [method=public jakarta.ws.rs.core.Response io.jans.configapi.rest.resource.auth.AuthConfigResource.patchAppConfigurationProperty(java.lang.String) throws com.github.fge.jsonpatch.JsonPatchException,java.io.IOException, interceptor=SimpleMethodInvocation [method=public java.lang.Object io.jans.configapi.interceptor.AuditLogInterceptor.aroundReadFrom(jakarta.interceptor.InvocationContext) throws java.lang.Exception]], auditLogConf:AuditLogConf [enabled=true, ignoreHttpMethod=[], headerAttributes=[User-inum]]
15-05 10:09:43.575 INFO  [qtp762476028-14] jans.configapi.interceptor.AuditLogInterceptor AuditLogInterceptor.java:87- Process Audit Log Interceptor - context:NonTerminalAroundInvokeInvocationContext [method=public jakarta.ws.rs.core.Response io.jans.configapi.rest.resource.auth.AuthConfigResource.patchAppConfigurationProperty(java.lang.String) throws com.github.fge.jsonpatch.JsonPatchException,java.io.IOException, interceptor=SimpleMethodInvocation [method=public java.lang.Object io.jans.configapi.interceptor.AuditLogInterceptor.aroundReadFrom(jakarta.interceptor.InvocationContext) throws java.lang.Exception]], auditLogConf:AuditLogConf [enabled=true, ignoreHttpMethod=[], headerAttributes=[User-inum]]

[imShakil]

Hi, @dhanan-np!

There is no error in that log. Please allow a moment for us to test the scenario.
Thanks

[imShakil]

Hi, @dhanan-np!

Can you share the command used to retrieve the token?

[imShakil]

Sorry @dhanan-np. It's been late. Can you please share the client config you have used for getting the token?

[dhanan-np]

Hello @imShakil,
Here is the details from database and screen-shots from the TUI for the client-

 select * from jansClnt where doc_id='1201.7eb01248-7be5-445f-baf3-21506b21e7fb' \G
*************************** 1. row ***************************
                                 doc_id: 1201.7eb01248-7be5-445f-baf3-21506b21e7fb
                            objectClass: jansClnt
                                     dn: inum=1201.7eb01248-7be5-445f-baf3-21506b21e7fb,ou=clients,o=jans
                                      o: NULL
                                jansGrp: NULL
                            displayName: SCIM client
                   displayNameLocalized: {"v": ["{}"]}
                            description: NULL
                                   inum: 1201.7eb01248-7be5-445f-baf3-21506b21e7fb
                             jansAppTyp: native
                     jansClntIdIssuedAt: NULL
                         jansClntSecret: zntqmp8QA9uhBwXOZLQ0eQ==
                    jansClntSecretExpAt: NULL
                                    exp: NULL
                                    del: 0
                            jansClntURI: NULL
                   jansClntURILocalized: {"v": ["{}"]}
                            jansContact: {"v": []}
                       jansDefAcrValues: {"v": []}
                          jansDefMaxAge: 200
                           jansGrantTyp: {"v": ["client_credentials", "refresh_token", "authorization_code"]}
                    jansIdTknEncRespAlg: RSA-OAEP
                    jansIdTknEncRespEnc: NULL
                 jansIdTknSignedRespAlg: RS256
                   jansInitiateLoginURI: NULL
                            jansJwksURI: NULL
                               jansJwks: NULL
                            jansLogoURI: NULL
                   jansLogoURILocalized: {"v": ["{}"]}
                          jansPolicyURI: NULL
                 jansPolicyURILocalized: {"v": ["{}"]}
              jansPostLogoutRedirectURI: {"v": []}
                        jansRedirectURI: {"v": ["https://my-dummy-host/.well-known/scim-configuration"]}
              jansRegistrationAccessTkn: NULL
                       jansReqObjSigAlg: NULL
                       jansReqObjEncAlg: NULL
                       jansReqObjEncEnc: NULL
                             jansReqURI: {"v": []}
                            jansRespTyp: {"v": ["code", "token", "id_token"]}
                              jansScope: {"v": ["inum=1200.346095,ou=scopes,o=jans", "inum=1200.7D578C,ou=scopes,o=jans", "inum=1200.293513,ou=scopes,o=jans", "inum=1200.6F2056,ou=scopes,o=jans", "inum=1200.082B40,ou=scopes,o=jans", "inum=1200.AE14CA,ou=scopes,o=jans", "inum=1200.8C9E9A,ou=scopes,o=jans", "inum=1200.1A255D,ou=scopes,o=jans", "inum=1200.CFCD6B,ou=scopes,o=jans", "inum=1200.121040,ou=scopes,o=jans", "inum=1800.01.5,ou=scopes,o=jans", "inum=1800.01.3,ou=scopes,o=jans", "inum=1800.01.4,ou=scopes,o=jans", "inum=1800.01.51,ou=scopes,o=jans", "inum=1800.01.12,ou=scopes,o=jans"]}
                              jansClaim: {"v": []}
                jansSectorIdentifierURI: NULL
                      jansSignedRespAlg: NULL
                         jansSubjectTyp: public
              jansTknEndpointAuthMethod: client_secret_basic
              jansTknEndpointAuthSigAlg: NULL
                             jansTosURI: NULL
                    jansTosURILocalized: {"v": ["{}"]}
                        jansTrustedClnt: 0
                   jansUsrInfEncRespAlg: NULL
                   jansUsrInfEncRespEnc: NULL
                          jansExtraConf: NULL
                   jansClaimRedirectURI: {"v": []}
                     jansLastAccessTime: NULL
                      jansLastLogonTime: NULL
                  jansPersistClntAuthzs: 0
                  jansInclClaimsInIdTkn: 0
                     jansRefreshTknLife: 86400
                           jansDisabled: 0
                          jansLogoutURI: {"v": ["null"]}
                 jansLogoutSessRequired: 0
                                jansdId: NULL
                  jansAuthorizedOrigins: {"v": []}
                              tknBndCnf: NULL
                     jansAccessTknAsJwt: 1
                    jansAccessTknSigAlg: RS256
                      jansAccessTknLife: 21600
                             jansSoftId: NULL
                            jansSoftVer: NULL
                      jansSoftStatement: NULL
                           jansRptAsJwt: 0
                              jansAttrs: {"tlsClientAuthSubjectDn":null,"runIntrospectionScriptBeforeJwtCreation":false,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"updateTokenScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":[],"rptClaimsScripts":[],"ropcScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":null,"jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null,"jansSubAttr":null,"redirectUrisRegex":null,"jansAuthorizedAcr":[],"jansDefaultPromptLogin":false,"idTokenLifetime":null,"allowOfflineAccessWithoutConsent":null,"minimumAcrLevel":-1,"minimumAcrLevelAutoresolve":null,"additionalTokenEndpointAuthMethods":[],"minimumAcrPriorityList":[]}
         jansBackchannelTknDeliveryMode: poll
jansBackchannelClntNotificationEndpoint: NULL
          jansBackchannelAuthnReqSigAlg: NULL
        jansBackchannelUsrCodeParameter: 0

[imShakil]

Hi, @dhanan-np!

Can you please modify the json data in this way? Please keep in mind, it will replace if there are any custom value already. If you want to keep them, add all of them in this operation as well.

[
    {
        "op": "add",
        "path": "authorizationRequestCustomAllowedParameters",
        "value": [{
            "paramName": "bcAuthnToken",
            "returnInResponse": true
        }]
    }
]

[dhanan-np]

Hello @imShakil ,
I had already tried this. I am still getting the error.
Can we please connect if possible?

[imShakil]

Hello @imShakil , I had already tried this. I am still getting the error. Can we please connect if possible?

Can please try to attempt with our config-cli method? just wanna make sure api is working fine at your end.

Sure, we can connect anytime. How do you wanna connect?

[dhanan-np]

We can connect on Gitter:
@dhanan_np_gitlab:gitter.im

[imShakil]

Hi @dhanan-np

Does jans tui work since you got id_token expired?
If you can navigate through jans-tui then you should be able to perform that command as well. What is the scenario in your case?

[ossdhaval]

@dhanan-np @imShakil id_token expiry behavior got recognized as an issue and got fixed. Here

We are still looking for a workaround if there is any to get existing setups out of the situation. Will share soon.

[imShakil]

Thanks, @ossdhaval

@dhanan-np Can you please confirm whether this command is working for you?

/opt/jans/jans-cli/config-cli.py --operation-id patch-properties --data back_chnnel_auth.json

[ossdhaval]

Hi @dhanan-np

Here is the workaround:

Edit this file /root/.config/jans-cli.ini and remove these keys: user_data, access_token_enc

[dhanan-np]

Hi @dhanan-np

Does jans tui work since you got id_token expired? If you can navigate through jans-tui then you should be able to perform that command as well. What is the scenario in your case?

Hello @imShakil , sorry for replying late. I was on leave for some family rituals.

I didn't check for that, as I was always running the TUI from my local machine.