Troubleshooting oauth token exchange on cloud medplum #support

Troubleshooting oauth token exchange on cloud

altintx

12/11/2023, 11:46 PM

We use clerk.dev for auth, and have configured an oauth application within clerk to do a token exchange with medplum. Things appear to pass through clerk appropriately, and wind up back at api.medplum.com/auth/external?code=...&state=... but medplum responds with an OperationOutcome listing

Failed to verify code - check your identity provider configuration

. I'm trying to diagnostically see what/why Medplum is erroring but there are no OperationOutcome records showing within my project. The

auth/external

URL includes a state JSON parameter that lists the correct projectID/clientID/bunch-of-other-stuff. Does Medplum cloud expose other details? Do I need to selfhost medplum to watch the authentication flow? Just trying to find the natural troubleshooting flow as I work through these issues.

rahul1

12/12/2023, 6:06 AM

Hi @altintx - yes unfortunately this flow is a bit hard to debug. For security reasons, we're not allowed to share additional details in the returned error

rahul1

12/12/2023, 6:06 AM

Are you able to run on localhost? We log any errors we get from clerk here https://github.com/medplum/medplum/blob/c764225a03a9ef07f1ec9c1c55c08903314c9104/packages/server/src/auth/external.ts#L166-L201

rahul1

12/12/2023, 6:07 AM

This erorr typically means that clerk returned an error to our server. Running on localhost and catching the log would beone way to debug

altintx

12/12/2023, 4:59 PM

Thank you. Stepping through with the code you referenced it looks like the other side doesn't support token exchanges.

rahul1

12/13/2023, 9:55 PM

Hi @altintx , do you mind sharing the error message you received from clerk? In our experience, sometimes there are some settings around how to configure PKCE that cause issues

altintx

12/13/2023, 10:27 PM

Copy code

{
  "error": "unsupported_grant_type",
  "error_description": "The authorization grant type is not supported by the authorization server"
}

altintx

12/13/2023, 10:29 PM

We tried every permutation of PKCE based on earlier support threads seen here, but it's token exchange of any kind. They've said that they're looking into it.

rahul1

12/14/2023, 12:44 AM

Got it. Well thanks for putting the work into debugging. Please let me know if they come to a resolution. We'd love to support Clerk

reshma

12/16/2023, 4:52 PM

It's possible there is an issue on the Clerk side... some community members have run into issues in the past https://discord.com/channels/905144809105260605/905144809105260608/1120432274761072834

altintx

12/20/2023, 7:22 PM

Clerk support gave me a definitive "we don't support this" today. I'm going to explore the deprecated alternate authorization method, and barring that, see about some kind of bridge on my side

rahul1

12/20/2023, 10:23 PM

Thanks for circling back @altintx !

159 Views

Previous Next