OpenIddict: multiple Orchard Core microservices and authentication flow using an SSO OpenIddict Server microservice

[MarGraz]

Hi Everyone,

I have a case similar to this one, which we already solved.
We now have a new case that is quite similar, but with a difference that is causing us problems.

Here is how our Orchard Core 1.8.3 microservices are set up:

Our Environment:

• Frontend "Angular App" that calls all the microservices via API endpoints
• Orchard Core 1.8.3 microservice called SSO (it has all the OpenId Applications and is our OpenIddict Server, available at: http://host.docker.internal:12150)
• Orchard Core 1.8.3 microservice called Users (custom API that needs to return some info by also contacting the SSO microservice)
• Orchard Core 1.8.3 microservice called Books (custom API that needs to return some info by also contacting the Users microservice)

Our Flow:

1. Our Angular App is authenticated by calling the SSO (using Authorization Code Flow).
2. The Angular App then calls the Books microservice's custom controller with the token provided by the SSO.
3. The Books microservice must validate the received token by calling the SSO microservice. If the user is authorized, they can access the action; otherwise, they cannot.
4. Inside the Books handler method, we make a call to the Users microservice to retrieve some information we need, using as a Bearer Token, the token received from the SSO through the Client Credential Flow. Unfortunately when Books calls Users, we get a 401 error: "Invalid_token. The specified token cannot be used with this resource server".

Maybe @kevinchalet (sorry for the direct mention) can help us understand what we configured wrong.

Thank you

---

Here some screenshots:

Books Token Validation

Users Token Validation

SSO Authorization Server

SSO User Application

SSO Book Application

How we get the Bearer to call the Books endpoints (Postman example)

[MarGraz]

Hi everyone,

In the end, we fixed the problem. It was caused by a missing Scope when we retrieved the Bearer Token in the call at point 4 (here). However, the Bearer Token for the call between Books and Users was incomplete. The missing Scope was Books_SSO 🤯.

The error "Invalid_token. The specified token cannot be used with this resource server" was not really clear in this case, maybe @kevinchalet could use a more specific error. I don't know if it's possible for you to intercept this specific case.

Thank you