What does OAuth2 Error from Authentication Server mean in Membrane?

After a login redirect, the authorization server sent the browser back to Membrane with an error parameter instead of an authorization code. The server refused to issue a code, for example because the user denied consent or the client registration is wrong.

How can I show my own error page instead of this error?

Set afterErrorUrl on the oauth2Resource2 plugin. Membrane then sends the user to that URL and posts the error and its description to it.

Does production mode hide the details of this error?

No. This error is always sent with its details and the link to the documentation, even when Membrane runs in production mode.

500 Internal Server Error: OAuth2 Error from Authentication Server

Membrane API Gateway returns 500 with the title OAuth2 Error from Authentication Server when the authorization server sends the browser back to the OAuth2 callback of the oauth2Resource2 plugin with an error instead of an authorization code. The authorization server refused the login. This is not a malfunction of Membrane.

The Error Response

The response contains the status 500, the title OAuth2 Error from Authentication Server, the error_description sent by the authorization server as detail, the problem type https://membrane-api.io/problems/security and a link to this page. The type security means that the error occurred during authentication. The user's session is cleared.

How the OAuth2 Login Works

The oauth2Resource2 plugin redirects users without a session to the authorization server. After the login, the server redirects the browser back to the callback path of the gateway with a code, which Membrane exchanges for tokens. If the server cannot issue a code, it redirects back with the parameters error and error_description instead, as defined in RFC 6749.

Common Causes

The User Cancelled the Login or Denied Consent

The user aborted the login or did not grant the requested permissions. The error code is usually access_denied.

The Requested Scope Is Not Allowed

The gateway requests a scope that the client is not allowed to use. The error code is invalid_scope.

The Client Registration Does Not Match

The client ID or the redirect URI configured on the gateway does not match the registration at the authorization server. Typical error codes are unauthorized_client and invalid_request.

The Authorization Server Had a Problem

The server reported server_error or temporarily_unavailable. Retry later or check the server.

How to Fix It

User: log in again and grant the requested permissions.
Operator: look for the warn-level log line OAuth2 Error from Authentication Server: .... It contains the OAuth2 error code.
Operator: fix the client registration, the redirect URI or the requested scopes accordingly.
Operator: to show your own error page instead of this problem response, set afterErrorUrl on oauth2Resource2. The error and its description are posted to that URL.

See OAuth2 using Postman for an example setup.

Details in Production Mode

Unlike most errors, this error is sent with its title, detail and the link to this page even when Membrane runs in production mode. Setting production: true in the configuration document does not remove them. The detail is the description written by the authorization server.