Getting "Failed to authorize: Null intent received"

[antoniodourado]

I'm haveing this issue after I authorize the login within my browser. There is no underscore or uppercase in my project. Anyone to help me out?

[ahmednfwela]

Do you get this in android/ios or web ?

[ahmednfwela]

seems like yet another problem with jose #9
what openid provider are you using? is it spec compliant ?

[ahmednfwela]

Thanks, I have seen the discovery document, and I see the problem now.
the jwks uri used in your configuration returns this:

[
  {
    "n": "xxx",
    "e": "xxx",
    "kty": "xxx",
    "kid": "xxx",
    "alg": "RS256",
    "use": "sig"
  }
]

but it should be:

{
"keys": [
  {
    "n": "xxx",
    "e": "xxx",
    "kty": "xxx",
    "kid": "xxx",
    "alg": "RS256",
    "use": "sig"
  }
]
}

[ahmednfwela]

Please check https://datatracker.ietf.org/doc/html/rfc7517#section-5

A JWK Set is a JSON object that represents a set of JWKs. The JSON
object MUST have a "keys" member, with its value being an array of
JWKs. This JSON object MAY contain whitespace and/or line breaks.

[antoniodourado]

Thank you! I'll ask for the server team to make implementation and I'll let you know if the issue persists!

[ahmednfwela]

You are welcome! I am also available on email if you don't want to share any private information on github:
[email protected]

[antoniodourado]

It seems I got the auth process. However, I'm getting the following issues:

1. Failed to verify id_token, using unverified instead. - We are using public client, is it the reason?
2. can't monitor user session due to lack of sessionState (null) or checkSessionIframe (null) - I see that we don't have the Iframe on discovery, but how about the session state?
3. When I authorize with the server, it's being shown two instances of the same app to open the redirect link. One of them I get the original error message of null intent but get redirected and the other I manage to auth/get user but I'm not redirected and get the messages 1 and 2.

Any ideas?

[ahmednfwela]

I should state that reducing the refresh token duration isn't a good option when scaling for large amounts of users.

[antoniodourado]

The verification is failing due another issue on the auth server and their team is solving it.

Regarding the login method, it is not being called multiple times. It is very weird.

[ahmednfwela]

I am thinking it may be a bug on the server that redirects to the same page in a new tab? but maybe i am wrong

[antoniodourado]

It seems that removing the intent filter in AndroidManifest.xml redirected from the browser to my app. However the route is completely ignored. Should I work on it manually throught redirect from GoRoute?

[ahmednfwela]

you don't need to use intent filters if you add the gradle entry as explained in the setup document
https://bdaya-dev.github.io/oidc/oidc-getting-started/#appauth-android-setup

going back to the original url is a different problem that depends on your routing package, and is solved in the example here

oidc/packages/oidc/example/lib/main.dart

Lines 33 to 70 in f73bda8

	GoRoute(
	path: '/secret-route',
	redirect: (context, state) {
	final user = app_state.cachedAuthedUser.of(context);
	if (user == null) {
	return Uri(
	path: '/auth',
	queryParameters: {
	// Note that this requires setPathUrlStrategy(); from `package:url_strategy`
	// and set
	OidcConstants_Store.originalUri: state.uri.toString(),
	},
	).toString();
	}
	return null;
	},
	builder: (context, state) => const SecretPage(),
	),
	GoRoute(
	path: '/auth',
	redirect: (context, state) {
	//
	final user = app_state.cachedAuthedUser.of(context);
	if (user != null) {
	final originalUri = state
	.uri.queryParameters[OidcConstants_Store.originalUri];
	if (originalUri != null) {
	return originalUri;
	}
	return '/secret-route';
	}
	return null;
	},
	builder: (context, state) => const AuthPage(),
	),
	],
	),

where secret page represents a page that should be guarded by auth.