When trying to log in to Web or Library after having configured OIDC as authentication mode, login fails with specific errors:
In Strategy Web: ”HTTP Status 401 - Unauthorized" error when trying to access with OIDC:
In OIDC log:
[https-openssl-nio-8443-exec-8] ERROR com.microstrategy.auth.oidc.OidcLoginFailureHandler - Login failed
org.springframework.security.oauth2.core.OAuth2AuthenticationException: [invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: 401 Unauthorized: [no body]
In Strategy Library: "Application Error - Sorry, an error has occurred."
MicroStrategyLibrary-MicroStrategyLibrary.log:
"message":"RestError [code=ERR001, iServerErrorCode=0, message=[invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: 401 Unauthorized: [no body], httpStatusCode=500, ticketId=bfddb5ac20a341dbbf76776a68c78fde]"
This is usually due to the clientSecret parameter being invalid - either clientSecret is expected from IDP side or wrong secret value is set in OidcConfig.json. Or no secret is needed on IDP side, but the OidcConfig.json has a secret configured.
Please make sure to confirm what is set/needed on IDP side and adjust the configuration on Strategy side accordingly.
Certain IDPs like Azure allow for Web Client and Public Client > Mobile and desktop applications to be configured together:
However, if a client secret is indeed needed and your application is set as a Web client, you should also add your application URI as a Web client, not Public client, on Azure side:
If it is added as a Public client, then no secret is expected, but the OIDC configuration from Strategy side is using a client secret and hence, above error will occur.
Generally, more information on the two different OIDC authentication workflows (PKCE vs Client secret) can be found here:
https://community.microstrategy.com/s/article/KB485144-Open-ID-Connect-OIDC-Authentication?language=en_US
