hydra-cli: hydra token user --audience

[pommelinho]

Hey,

i created my client with the following command

clients create --skip-tls-verify --id gastromatic-web-server --secret secret-gastromatic-web-server --grant-types authorization_code,refresh_token --response-types token,code,id_token --scope openid,offline --callbacks http://127.0.0.1:9010/callback --name gastromatic-web-server --audience gastrograph,test

and then start the example web server with
token user --skip-tls-verify --port 9010 --auth-url https://localhost:9000/oauth2/auth --token-url https://hydra:4444/oauth2/token --client-id gastromatic-web-server --client-secret secret-gastromatic-web-server --scope openid,offline --audience gastrograph,test

However when doing the Oauth Auth Flow i get the following error:
| time=2020-12-22T06:10:27Z level=error msg=An error occurred func=github.com/ory/hydra/x.LogError file=/home/ory/x/errors.go:49 audience=application error=map[debug: message:invalid_request reason:Requested audience 'gastrograph+test' has not been whitelisted by the OAuth 2.0 Client. status:Bad Request status_code:400 trace:] http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 accept-encoding:gzip, deflate, br accept-language:de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 cache-control:max-age=0 cookie:connect.sid=s%3A2Ig4Nv6wO6hkir281DvU-nT_g2VKaUkZ.mjeLqlrxT8Va%2BzLAVPbMRYMjoFgpxtMMzpkI4Vklpq0; _ga=GA1.1.410087233.1608530190; _gid=GA1.1.1630007305.1608530190; gastro_=%7B%22uid%22%3A%2217683e038e54ec-09c781828a4f1b-397e0a5c%22%2C%22browser%22%3A%7B%22%24os%22%3A%22Linux%22%2C%22%24browser%22%3A%22Chrome%22%2C%22%24referrer%22%3A%22http%3A%2F%2Flocalhost%3A3000%2Fapp%2F%22%2C%22%24referring_domain%22%3A%22localhost%3A3000%22%2C%22%24current_url%22%3A%22http%3A%2F%2Flocalhost%3A3000%2Fapp%2F%23%2Fplanner%22%7D%2C%22search%22%3A%7B%7D%2C%22accountId%22%3A%2255378f3c78d6a600001c57fb%22%2C%22organizationId%22%3A%2258ddfb9725386c267c5fee5a%22%2C%22locationId%22%3A%225a1fc3c4fd837d0f31ad5c30%22%7D; _ga_N7NP9EH1Q6=GS1.1.1608530190.1.1.1608531135.0; intercom-session-avrmo69w=NVN6YTVLVkVFeDlKS3FBM2JXaU1mV1MrS1ZWZEJiN20zTk5OTFFuZkpyR3Jzc2FBVzFJWlJjL1JCVHN3YU9lTC0tN291SGhLMDg4Vlp1QmNlMjF6KytvZz09--aef767c00f0df293d451138654a1b30f7f2b7780; XSRF-TOKEN=JsaG2Wp5-uyZwGc-CeBER7alPHUWJ_WBuWGs; _csrf=wiQDn404rykg1bzfdmMpLedg; oauth2_authentication_csrf=MTYwODYxNzI5NnxEdi1CQkFFQ180SUFBUkFCRUFBQVB2LUNBQUVHYzNSeWFXNW5EQVlBQkdOemNtWUdjM1J5YVc1bkRDSUFJREEyTVRabFl6RTFZVEJtTURSak1UQTVNMlprT1dJNE1tVTJaalJoTkdGaXzR6U46HzQneBJW_PgM-P_pjvAbIDE6oI9lYwA5tSc1jQ==; oauth2_consent_csrf=MTYwODYxNzMwN3xEdi1CQkFFQ180SUFBUkFCRUFBQVB2LUNBQUVHYzNSeWFXNW5EQVlBQkdOemNtWUdjM1J5YVc1bkRDSUFJR0ZoTVRVMk1tTXdNRGN3WWpSaVpUSmhaV014T0RaaE1tTTROMlZsTWpRM3wbzGvhCUEOuMP4F0lcgSPs3DY9in_NcyZiERSP59VLDw== referer:http://127.0.0.1:9010/ user-agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36] host:localhost:9000 method:GET path:/oauth2/auth query:audience=gastrograph%2Btest&client_id=gastromatic-web-server&max_age=0&nonce=oeexzhkozaeaoepxnnrwrjxp&prompt=&redirect_uri=http%3A%2F%2F127.0.0.1%3A9010%2Fcallback&response_type=code&scope=openid+offline&state=rrgykrslchxugfyrmceelsxh remote:172.20.0.1:35898 scheme:https] service_name=ORY Hydra service_version=v1.9.0-alpha.3

Requested audience 'gastrograph+test' has not been whitelisted..... but this i do not understand as i whitelisted the two audiences IMHO when creating the client above?

[k9ert]

I can't reproduce that right now but i can see the use of IP-addresses and "localhost" at the same time as a potential issue. I'd suggest to only use "127.0.0.1" instead of "localhost". Maybe that makes a difference?!

[pommelinho]

Hey, thanks for the response, unfortunately this does not solve the issue.

[k9ert]

I tried to reproduce and could get it to work by removing the ",test" when starting "token user". So it seems to work requesting one audience but not more than one. Also it seems that both values got added properly via "+" like this:

GET
	http://127.0.0.1:4444/oauth2/auth?audience=gastrograph+test&client_id=gastromatic-web-server&max_age=0&nonce=ryqhoxnmvzxgihexkgrqlbmp&prompt=&redirect_uri=http://127.0.0.1:9010/callback&response_type=code&scope=openid offline&state=kgyactxzdwgjikwawycqenip

And it's also correct how you added both audiences:

➜  hydra git:(master) hydra clients get gastromatic-web-server --endpoint  http://127.0.0.1:4445/
{
	"audience": [
		"gastrograph",
		"test"
	],
	"client_id": "gastromatic-web-server",
	"client_name": "gastromatic-web-server",
	"created_at": "2020-12-22T13:19:13.000Z",
	"grant_types": [
		"authorization_code",
		"refresh_token"
	],
	"jwks": {},
	"metadata": {},
	"redirect_uris": [
		"http://127.0.0.1:9010/callback"
	],
	"response_types": [
		"token",
		"code",
		"id_token"
	],
	"scope": "openid offline",
	"subject_type": "public",
	"token_endpoint_auth_method": "client_secret_basic",
	"updated_at": "2020-12-22T13:19:13.008Z",
	"userinfo_signed_response_alg": "none"
}
➜  hydra git:(master) 

One other aspect is the request of an id-token via "--scope openid". That is imho not compatible with specifying an audience but it did not make a difference removing that.

So i assume you definitely want to request two audiences, right?!

[pommelinho]

hey, yeah i also figured out that with one audience it is working. however i want to request two audiences as you said.
So the issue seems to be that they are concatenated via '+' and not via ' ' in the /oauth2/auth, right?

[pommelinho]

@k9ert can you verify this?

[aeneasr]

Hey there, this looks like a bug to me. Would you be able to open an issue regarding this and maybe even a PR? My hunch says this could be something in github.com/ory/fosite.