topic Re: Full authentication is required to access this resource when trying to register client in Developers

Full authentication is required to access this resource when trying to register client

klay_martens — Thu, 18 Feb 2021 06:09:03 GMT

Hi all. I am thinking this may be a config issue. When trying to register a client for Viya, I get the above error (I am following this document https://developer.sas.com/reference/auth/#register)

I am not sure if perhaps there was a deployment or config step left or what, and the logs are extremely unhelpful. Anyone run into this, maybe?

Re: Full authentication is required to access this resource when trying to register client

joeFurbee — Fri, 19 Feb 2021 02:04:33 GMT

Hi @klay_martens,

Can you provide the call you made when you received the error? What method did you use to attempt the registration? cURL? Postman, something else?

Also, feel free to follow the instructions in my blog post on the same subject.

Thanks,

Joe

Re: Full authentication is required to access this resource when trying to register client

klay_martens — Fri, 19 Feb 2021 05:56:56 GMT

Hi Joe,

I tried with both CURL and PostMan - same error both times...

This is the request I am using to generate the token (which works)

curl -k -X POST "<url>/SASLogon/oauth/clients/consul?callback=false&serviceId=app" \
-H "X-Consul-Token: <token>"

Then the registration post fails:

curl -k -v -X POST "<url>/SASLogon/oauth/clients" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <access token from step 1>" \
-d '{
"client_id": "mdsnew",
"client_secret": "itsnotasecret",
"scope": ["openid","SASScoreUsers"],
"authorized_grant_types": ["password"],
"redirect_uri": "urn:ietf:wg:oauth:2.0:oob", "access_token_validity": 43199 }'

This kicks back the following reply:

> Content-Length: 259
>
* upload completely sent off: 259 out of 259 bytes
< HTTP/1.1 500
< Date: Fri, 19 Feb 2021 05:47:29 GMT
< Server: Apache/2.4
< SAS-Service-Response-Flag: true
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< X-Frame-Options: DENY
< Content-Type: application/vnd.sas.error+json; version=2;charset=UTF-8
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Vary: User-Agent
< Connection: close
< Transfer-Encoding: chunked
<
* Closing connection 0
{"errorCode":1008,"message":"A data error occurred that prevented the successful completion of the operation.","details":["traceId: ed44cc0ad1c3a263","path: /SASLogon/oauth/clients"],"remediation":null,"links":[],"version":2,"httpStatusCode":500}

If I access the server with the URL and traceId above, I get

<oauth>
<error_description>Full authentication is required to access this resource</error_description>
<error>unauthorized</error>
</oauth>

Log files on the server are super unhelpful as well - this is from /opt/sas/viya/config/var/log/saslogon/default/sas-saslogon_*.log.

Not sure if we can find more details elsewhere? Its a bit of a frustrating error!

021-02-19 07:47:30.006 ERROR 8733 --- [-auto-1-exec-17] com.sas.commons.rest.ExceptionLog        : service [ed44cc0ad1c3a263] org.springframework.dao.EmptyResultDataAccessException: Incorrect result size: expected 1, actual 0

I am pretty sure I am submitting the request correctly - thinking there might be a config problem somewhere...

Re: Full authentication is required to access this resource when trying to register client

klay_martens — Sat, 20 Feb 2021 04:56:06 GMT

Ok so...an update on this: it appears that the problem was down to a slight difference in URL for the AWS server on the private subnet. One the admins lucked into trying the client registration with a different URL....hey presto it works.

Never in a million years would that have occurred to me as the source of the problem!

Re: Full authentication is required to access this resource when trying to register client

joeFurbee — Mon, 22 Feb 2021 12:35:36 GMT

Glad it worked out @klay_martens. Let us know if you're working on anything interesting. We're always on the lookout for compelling use cases to share.

Re: Full authentication is required to access this resource when trying to register client

bheinsius — Tue, 25 May 2021 17:43:44 GMT

Hi @klay_martens ,

Ik get the same error as you:

{"errorCode":1008,
 "message":"A data error occurred that prevented the successful completion of the operation.",
 "details":["traceId: 06902c391b830125",
            "path: /SASLogon/oauth/clients"],
 "remediation":null,
 "links":[],
 "version":2,
 "httpStatusCode":500
}

and I am also running on AWS. Can you share what you changed to make it work?

- Bart

Re: Full authentication is required to access this resource when trying to register client

klay_martens — Wed, 26 May 2021 11:27:59 GMT

There were two URL's we could use to access the service. Client registration only worked on one of them. This may be the same as your current issue, or there may be something else wrong.

Re: Full authentication is required to access this resource when trying to register client

brendanb — Wed, 25 May 2022 10:15:08 GMT

Hi, I am having this issue. Your solution mentions two urls, which is the other one? Thanks in advance.

Re: Full authentication is required to access this resource when trying to register client

klay_martens — Wed, 25 May 2022 10:23:04 GMT

So I think you need to be sure you are using the right client. As I understand it, this is caused by a multi tenant install, so that was the 2 URL's - had to be sure that the correct one was used to register the client. This issue does not show itself on a single tenant installation.

Re: Full authentication is required to access this resource when trying to register client

brendanb — Wed, 25 May 2022 11:01:37 GMT

Aha!, I was using tenant specific URL, removed tenant and voila. Thank you