OAuth2 - Unable to Access All Applications (403 Forbidden)

[ramkumar261101]

Description:
I recently created an OAuth2 application to integrate multiple applications using a single provider. While I can log in and view the currently logged-in user's information, I encounter a 403 Forbidden error when trying to access all applications.

What I Have Implemented:

Successfully authenticated and retrieved the logged-in user's info.
Attempting to retrieve a list of all applications results in a 403 Forbidden error.
Possible Causes Investigated:

Verified OAuth2 scopes and permissions.
Checked token roles and claims.
Ensured the API has the correct authorization settings.
Code Snippets: (Include relevant parts of your code for authentication, token handling, and API calls)

Expected Behavior:

Users with the correct roles/permissions should be able to retrieve all applications without a 403 Forbidden error.
Questions:

What could be causing this authorization issue?
How can I ensure that my OAuth2 tokens have the required permissions for accessing all applications?

def get_auth_code():
auth_url = f"{AUTHORIZE_URL}?client_id={CLIENT_ID}&response_type=code&scope=openid email profile applications&redirect_uri={REDIRECT_URI}"
print(f"\n🔗 Open this URL in your browser: {auth_url}")
webbrowser.open(auth_url) # Opens in default browser
auth_code = input("\n📥 Enter the authorization code from the URL: ")
return auth_code

Step 2: Exchange Authorization Code for Access Token

def get_access_token(auth_code):
payload = {
"grant_type": "authorization_code",
"client_id": CLIENT_ID,
"client_secret": CLIENT_SECRET,
"code": auth_code,
"redirect_uri": REDIRECT_URI
}

response = requests.post(TOKEN_URL, data=payload)
if response.status_code == 200:
    token_data = response.json()
    print("\n✅ Token Response:", json.dumps(token_data, indent=2))
    return token_data
else:
    print(f"\n❌ Failed to get token (Status: {response.status_code}): {response.text}")
    return None

Step 3: Fetch User Info

def fetch_user_info(access_token):
headers = {"Authorization": f"Bearer {access_token}"}
response = requests.get(USERINFO_URL, headers=headers)

if response.status_code == 200:
    print("\n✅ User Info:", json.dumps(response.json(), indent=2))
else:
    print(f"\n❌ Error accessing user info (Status: {response.status_code}): {response.text}")

Step 4: Fetch All Applications

def fetch_all_applications(access_token):
headers = {
"Accept": "application/json",
"Authorization": f"Bearer {access_token}"
}
response = requests.get(APPLICATIONS_URL, headers=headers)

if response.status_code == 200:
    print("\n✅ Applications:", json.dumps(response.json(), indent=2))
elif response.status_code == 403:
    print("\n❌ 403 Forbidden - Check if token has correct scope or is expired.")
else:
    print(f"\n❌ Error fetching applications (Status: {response.status_code}): {response.text}")

Step 5: Refresh Token (if needed)

def refresh_access_token(refresh_token):
payload = {
"grant_type": "refresh_token",
"client_id": CLIENT_ID,
"client_secret": CLIENT_SECRET,
"refresh_token": refresh_token
}

response = requests.post(TOKEN_URL, data=payload)
if response.status_code == 200:
    new_token_data = response.json()
    print("\n🔄 Refreshed Token:", json.dumps(new_token_data, indent=2))
    return new_token_data
else:
    print(f"\n❌ Failed to refresh token (Status: {response.status_code}): {response.text}")
    return None

Run OAuth Flow

if name == "main":
auth_code = get_auth_code()
if auth_code:
token_data = get_access_token(auth_code)
if token_data:
access_token = token_data.get("access_token")
refresh_token = token_data.get("refresh_token")

        print("\n✅ Access Token:", access_token)
        fetch_user_info(access_token)
        fetch_all_applications(access_token)

        # If token expires, attempt refresh
        if refresh_token:
            print("\n🔄 Trying to refresh token...")
            new_token_data = refresh_access_token(refresh_token)
            if new_token_data:
                fetch_all_applications(new_token_data.get("access_token"))
    else:
        print("\n❌ Failed to obtain access token.")

✅ User Info: {
"sub": "akadmin",
"email": "ramkumar@zirrusone.com",
"email_verified": true,
"name": "authentik Default Admin",
"given_name": "authentik Default Admin",
"preferred_username": "akadmin",
"nickname": "akadmin",
"groups": [
"SecurityTeam",
"authentik Admins"
]
}