Unsupported type for the scope openid

[Popleys]

Hi There,Am using the below url and getting the following exception.Essentially am using the

response_type=token id_token and send the following request.Please advise what could be the issue i just followed the OTK 4.0 version doc steps for it.

error=unsupported_response_type&error_description=None+of+the+supported+response_types+were+used

 

Request:

https://ssg92.dmn.com:8443/auth/oauth/v2/authorize?response_type=token%20id_token&scope=openid&client_id=1cde994e-f35c-4… 

[Barry Stern]

Are you including a nonce in your request? A nonce parameter is required for response_type 'token id_token' if it is not present this will cause this error.

[Popleys]

Hi Barry,Am not including it,will add that and let you know the results.

[Popleys]

Hi Barry,

I got the following response, but i am logged in with a userID but i could not see the user id in the decoded jason token.I think it could be in sub which is sort of encrypted,could you pls suggest how could i get the userid from the below token for the authenticated user? 

{
"at_hash": "bJyegrnsaJz8IA4bl2CaGA",
"sub": "PwEUcutuQv-nG1AB4X3_rEbd_8b10xrP9Z4h-G_2Y3o",
"aud": "1cde994e-f35c-4a4f-a20f-12a1c99d8469",
"acr": "0",
"azp": "1cde994e-f35c-4a4f-a20f-12a1c99d8469",
"auth_time": 1530283318,
"iss": "https://ssg92.mydmn.com:8443/connect",
"exp": 1530369775,
"iat": 1530283375,
"nonce": "11s3n61cciv"
}

[saspr02]

Hello!

sub contains a ppid (Pairwise Pseudonymous Identifier), it is a generated value based on the username, the client_id and a salt. OTK, by default, does not support 'plain' sub values. At the moment that cannot be changed.

I will take this as feedback for our product owner.

I hope this helps,

Sascha

[Zhijun He]

It sounds like you would like to retrieve user claims, in that case, you may call /openid/connect/v1/userinfo endpoint.

But you will need to implement the /openid/connect/v1/userinfo endpoint first, as by default, all the user attributes are hard coded in "OTK user Attribute Look Up" encapsulated assertion.

Open ID Connect Implementation Details - CA API Management OAuth Toolkit - 4.3 - CA Technologies Documentation 

[Zhijun He]

but the 'sub', 'preferred_username' and 'user_role' are real