Hi team,
I am unable to create client in esignet. Below is the steps I am following.
I am able to get access key from keycloak
--url http://<keycloak host>/auth/realms/mosip/protocol/openid-connect/token \
--header 'content-type: application/x-www-form-urlencoded' \
--data client_secret=<pms client secret> \
--data client_id=mosip-pms-client \
--data grant_type=client_credentials
And I am getting the csrf token from /v1/esignet/csrf/token end point. I am calling the /v1/esignet/client-mgmt/oidc-client api using the access_token which I got from the first curl and csrf token from the second api.
I am getting 401
Hello @Vijay_S
Can you confirm if the auth token is passed in the /v1/esignet/client-mgmt/oidc-client request header? The client management endpoint requires Bearer Token authorization.
As per the default configuration, “add_oidc_client” scope is expected to be allowed scope in the auth token.
## Transaction halted with prepare-signup-redirect wait time to resume back with complete-signup-redirect API
mosip.esignet.signup.halt.expire-seconds=1800
## ------------------------------------------ e-Signet binding ---------------------------------------------------------
mosip.esignet.binding.salt-length=16
mosip.esignet.binding.audience-id=esignet-binding
mosip.esignet.binding.key-expire-days=10
## -------------------------------------- Authentication & Authorization -----------------------------------------------
mosip.esignet.security.auth.post-urls={'${server.servlet.path}/client-mgmt/**' : {'SCOPE_add_oidc_client'} , \
\ '${server.servlet.path}/system-info/**' : { 'SCOPE_upload_certificate'},\
\ '${server.servlet.path}/binding/wallet-binding' : { 'SCOPE_wallet_binding'}, \
\ '${server.servlet.path}/binding/binding-otp' : { 'SCOPE_send_binding_otp'}}
mosip.esignet.security.auth.put-urls={'${server.servlet.path}/client-mgmt/**' : { 'SCOPE_update_oidc_client'} }
mosip.esignet.security.auth.get-urls={'${server.servlet.path}/system-info/**' : { 'SCOPE_get_certificate'} }
mosip.esignet.security.ignore-csrf-urls=${server.servlet.path}/oidc/**,${server.servlet.path}/oauth/**,\
${server.servlet.path}/actuator/**,/favicon.ico,${server.servlet.path}/error,\
${server.servlet.path}/swagger-ui/**,${server.servlet.path}/v3/api-docs/**,\
${server.servlet.path}/linked-authorization/link-transaction,${server.servlet.path}/linked-authorization/authenticate,\
regards,
Anusha_sunkadh:
add_oidc_client
Yes I am sending the access token and the token has add_oidc_client scope.
"scope": "profile email get_certificate add_oidc_client update_oidc_client upload_certificate",