nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

IOAuthAuthorizeHandler Throws "Invalid PKCE exception" even though the token request succeeds

EricLiu

Hi, I'm calling OAuthUserCredential.CreateAsync() in a try / catch block. This call gets routed to my own implementation of OAuthAuthorizeHandler.AuthorizeAsync().

From the authorizeUri parameter of AuthorizeAsync(), I can see the SDK passed in a "code_challenge" hash string. But since I don't know the verifier, I have to replace the challenge with my own for PKCE.

I generated a pair of "code_challenge" and "code_verifier" strings (Using default Base64Url.EncodeToString(), SHA256.Create()). I sent the "code_challenge" string in my OAuth2 authorization request. The "code_challenge_method" is "S256". This completes successfully and I get a code.

Then in my request to "https://www.arcgis.com/sharing/rest/oauth2/token, I have "code_verifier" set to the one I generated. I have "grant_type" set to "authorization_code". Along with other required parameters.

The response comes back with Status 200, OK. Using a JSON De-serializer on the response stream, I was able to extract the username, access token, refresh token ... etc. I then add these to a dictionary and return the dictionary in AuthorizeAsync().

After exiting from AuthorizeAsync(), the code went into my catch block (even though there was no exceptions in AuthorizeAsync()). The error was {"error":{"code":400,"error":"invalid_request","error_description":"Invalid PKCE code_challenge_verifier","message":"Invalid PKCE code_challenge_verifier","details":[]}}.

Is this a bug ? Or was I supposed to use the code_challenge provided by the SDK (if so how would I know the code_verifier).

.NET 9.0.302, Maui 9.0.100, ArcGIS Runtime 200.7 (also happens 200.8)

Finde mehr Beiträge mit dem Tag

Maui

Windows

NET Framework

iOS

Android

Accepted answers

MatveiStefarov

Hello Eric! I see the issue. You are seeing that error because the OAuthUserCredential workflow is designed to handle the PKCE exchange and Token request for you automatically. There is no need to manually post anything to /rest/oauth2/token.

When you implement IOAuthAuthorizeHandler, your only responsibility is to:

Launch the browser (or system web view) using the exact authorizeUri passed into the method (it already contains the correct code_challenge).
Listen for the redirect / protocol activation.
Return the "code" parameter from the redirect URI.

Once it has the "code", OAuthUserCredential can make an "authorization_code" request itself and retrieve all other information: username, access token, refresh token, etc.

You can take advantage of MAUI WebAuthenticator on iOS/Android or OAuth2Manager for WinUI to simplify the implementation of your authorization handler.

All comments

EricLiu

@MatveiStefarov I have a portal with IWA enabled. On Windows, it uses my IWA credentials and takes me directly to the OAuth2 page (via AuthorizeAsync), then I can sign in successfully. On iOS I can generate an ArcGISNetworkCredential (via username + password) and add it to the AuthenticationManager. After that I get an OAuth2 challenge and I can sign in like Windows.

But on Android, it hangs. I can generate & save the ArcGISNetworkCredential just fine like on iOS. But then when I call OAuthUserCredential.CreateAsync(), it takes me to AuthorizeAsync. I exit AuthorizeAsync successfully with the OAuth2 authorization code in the dictionary result; but it never exits to the line after OAuthUserCredential.CreateAsync() (doesn't get caught either).

If I manually exchange the OAuth authorization code for the access token (with the ArcGISNetworkCredential added to the HttpHandler making the request), I get a successful response + token. But it also hangs after returning from AuthorizeAsync() (ArcGIS is probably also attempting to exchange for the token and getting stuck).

For what its worth internally we have an old comment "_authMan.GetCredentialAsync hangs on Android when using IWA without anonymous access ...", so I wonder if we've known about an Android issue for a while.

Possibly related to the PreAuthenticate setting (on the HttpClientHandler or the ArcGISNetworkCredential) ?

Could you give me some pointers on why this is happening ?

MatveiStefarov

I hope that you will find working with network credentials easier than expected.

If you know the network credentials ahead of time, you can create an ArcGISNetworkCredential and add it to the AuthenticationManager before creating the OAuth credential.

Or, to prompt the user for network credentials as needed, implement a ChallengeHandler and set it on the AuthenticationManager. Your handler will be called when a service prompts for login, and you can create/return the appropriate credential based on given ServiceUri and AuthenticationType.

The only thing Maps SDK cannot help with is -- if loading the OAuth "authorize" URL has multiple layers of security, the browser will have to prompt for these credentials separately from the app.

EricLiu

Thank you Matvei, that worked! I believe exchanging the token manually allowed us to specify a NetworkCredential in our HttpClientHandler before making the request. I suppose if I want to do that now I have to inject the NetworkCredential somehow into the HttpRequest in IHttpMessageInterceptor.

MatveiStefarov

When you implement IOAuthAuthorizeHandler, your only responsibility is to:

Launch the browser (or system web view) using the exact authorizeUri passed into the method (it already contains the correct code_challenge).
Listen for the redirect / protocol activation.
Return the "code" parameter from the redirect URI.

Once it has the "code", OAuthUserCredential can make an "authorization_code" request itself and retrieve all other information: username, access token, refresh token, etc.

You can take advantage of MAUI WebAuthenticator on iOS/Android or OAuth2Manager for WinUI to simplify the implementation of your authorization handler.

EricLiu

Btw, is there documentation on what key / value pairs should be included in the result of AuthorizeAsync() ?

I've put in code, access_token, refresh_token, expires_in, username, ssl, refresh_token_expires_in. I also tried adding code_challenge and code_verifier but that did not fix my issue.

If I don't include the "code" kvp in my output, AuthorizeAsync() fails with missing authorization code. This wasn't required when using GenerateCredentialAsync() before (I've replaced it with OAuthUserCredential.CreateAsync()).

Nimm an der Unterhaltung teil

Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registriere ein kostenloses Konto.

Schnellzugriffe

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.