Hi Everyone
I am trying to use OAuth PKCE on Layer 7 API Gateway 11 with OTK 4.6, but I have been faced with some issue to build the request with curl.
- I got the sessionId and sessionData with /auth/oauth/v2/authorize
however, I was redirected to /auth/oauth/v2/authorize/login and when I submit the request using my admin credentials, I received the message:
<div class="container-fluid">
<div>
<h1>OAuth 2.0 Authorization Server</h1>
<div id="dynamicContent">
<p><b>error: </b>login_required<br/><b>error_description: </b>The resource owner could not be authenticated due to missing or invalid credentials</p>
</div>
<!-- Bottom of the website -->
<div class="row-fluid portal-footer">
<div class="span12">
<p class="portal-copyright">© CA Technologies. All rights
reserved.</p>
</div>
</div>
</div>
</div>
</div>
please, help me with the questions below:
- why doesn't my admin credentials work to login in OAuth 2.0 Authorization Server?
- Am I using the correct flow for PKCE?
- which role should I assign to the user to allow login in OAuth 2.0 Authorization Server?
- if I need to create a user to login in OAuth 2.0 Authorization Server, is it secure to shared credentials with SPA or mobile clients?