Debugging an authorisation process in Postman

user_434697 0
Viewed 220

I am testing an OAuth 2.0 authentication flow in postman.

  • I used Authorisation tab, New Access Token button to start the auth process.

enter image description here

  • Added the information in the form & pressed the Requested Token button. This opened a browser instance, in which I keyed-in the required credentials for authenticating a user.

  • Once the auth steps are completed, I am redirected to the localhost page in the browser instance that was opened for auth steps. (Note, redirect url is given during the filling in of the form for request-token and is part of the specs for OAuth 2.0.

  • This is where things go strange. On the redirected page on the localhost, I am still shown as not-signed-in, as there is no JWT (JSON Web Token) in the cookie/ local-storage.

enter image description here

  • However, back on the Postman main interface. If I press the Request Token once again, I get the JWT, which is what I want.

enter image description here

QUESTION:

Why do I have to press the request token again to fetch the JWT token. Presumably the JWT token was not returned by the auth server, hence the browser instance still not signed-in? Does pressing the request token make another POST request to auth server to retrieve the JWT token. What is the process flow here?

And how can I debug this?

Edit:

Pressing the sign-in button again on the web app, leads to the auth server error page. I suspect this is because the server has the auth token for the user so does not let the user signin again?

postman oauth-2.0 authentication debugging
1 Answers

How to debug Bearer token You can debug token received against client id and client secret using https://jwt.ms when you get token please be aware of properties:Issued at, Expired at, Issue to and issuer etc.

Now coming back to your shared details I am doubtful on Access token URL value it should be token provider url. The Azure token endpoint looks like: https://login.microsoftonline.com//oauth2/token

Once you get token then it checks authorization hence first you should get token and later it should hit to authorize endpoint. https://login.microsoftonline.com//oauth2/authorize

Also when you pass the token there are different flow and with Postman i believe it makes more easy to use Implicit flow. Please refer different flow here: https://datatracker.ietf.org/doc/html/rfc6749#page-8

For step by step approach on how to issue token using Azure AD please refer: https://docs.microsoft.com/en-us/rest/api/servicebus/get-azure-active-directory-token#use-postman-to-get-the-azure-ad-token

Hope it will help you to get token and continue with your further work.

user_116637560
Related