Full authentication is required to access this resource when trying to register client

[klay_martens]

Hi all. I am thinking this may be a config issue. When trying to register a client for Viya, I get the above error (I am following this document https://developer.sas.com/reference/auth/#register)

I am not sure if perhaps there was a deployment or config step left or what, and the logs are extremely unhelpful. Anyone run into this, maybe?

[joeFurbee]

Hi @klay_martens,

Can you provide the call you made when you received the error? What method did you use to attempt the registration? cURL? Postman, something else?

Also, feel free to follow the instructions in my blog post on the same subject. 

Thanks,

Joe

[klay_martens]

Hi Joe,

I tried with both CURL and PostMan - same error both times...

This is the request I am using to generate the token (which works)

curl -k -X POST "<url>/SASLogon/oauth/clients/consul?callback=false&serviceId=app" \
-H "X-Consul-Token: <token>"

Then the registration post fails:

curl -k -v -X POST "<url>/SASLogon/oauth/clients" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <access token from step 1>" \
-d '{
"client_id": "mdsnew",
"client_secret": "itsnotasecret",
"scope": ["openid","SASScoreUsers"],
"authorized_grant_types": ["password"],
"redirect_uri": "urn:ietf:wg:oauth:2.0:oob", "access_token_validity": 43199 }'

This kicks back the following reply:

> Content-Length: 259
>
* upload completely sent off: 259 out of 259 bytes
< HTTP/1.1 500
< Date: Fri, 19 Feb 2021 05:47:29 GMT
< Server: Apache/2.4
< SAS-Service-Response-Flag: true
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< X-Frame-Options: DENY
< Content-Type: application/vnd.sas.error+json; version=2;charset=UTF-8
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Vary: User-Agent
< Connection: close
< Transfer-Encoding: chunked
<
* Closing connection 0
{"errorCode":1008,"message":"A data error occurred that prevented the successful completion of the operation.","details":["traceId: ed44cc0ad1c3a263","path: /SASLogon/oauth/clients"],"remediation":null,"links":[],"version":2,"httpStatusCode":500}

If I access the server with the URL and traceId above, I get

<oauth>
<error_description>Full authentication is required to access this resource</error_description>
<error>unauthorized</error>
</oauth>

Log files on the server are super unhelpful as well - this is from /opt/sas/viya/config/var/log/saslogon/default/sas-saslogon_*.log.

Not sure if we can find more details elsewhere? Its a bit of a frustrating error!

021-02-19 07:47:30.006 ERROR 8733 --- [-auto-1-exec-17] com.sas.commons.rest.ExceptionLog        : service [ed44cc0ad1c3a263] org.springframework.dao.EmptyResultDataAccessException: Incorrect result size: expected 1, actual 0

I am pretty sure I am submitting the request correctly - thinking there might be a config problem somewhere...

[klay_martens · Accepted solution]

Ok so...an update on this: it appears that the problem was down to a slight difference in URL for the AWS server on the private subnet. One the admins lucked into trying the client registration with a different URL....hey presto it works.

Never in a million years would that have occurred to me as the source of the problem!

[joeFurbee]

Glad it worked out @klay_martens. Let us know if you're working on anything interesting. We're always on the lookout for compelling use cases to share.

[bheinsius]

Hi @klay_martens ,

Ik get the same error as you:

{"errorCode":1008,
 "message":"A data error occurred that prevented the successful completion of the operation.",
 "details":["traceId: 06902c391b830125",
            "path: /SASLogon/oauth/clients"],
 "remediation":null,
 "links":[],
 "version":2,
 "httpStatusCode":500
}

and I am also running on AWS. Can you share what you changed to make it work?

- Bart

[klay_martens]

There were two URL's we could use to access the service. Client registration only worked on one of them. This may be the same as your current issue, or there may be something else wrong.

[brendanb]

Hi, I am having this issue. Your solution mentions two urls, which is the other one? Thanks in advance.

[klay_martens]

So I think you need to be sure you are using the right client. As I understand it, this is caused by a multi tenant install, so that was the 2 URL's - had to be sure that the correct one was used to register the client. This issue does not show itself on a single tenant installation.

[brendanb]

Aha!, I was using tenant specific URL, removed tenant and voila. Thank you