Question about invalid_request_object

[maldworth]

IdentityServer version

7.X.X

.NET version

.NET 8.0

Description

I'm trying to run a self hosted version of: https://github.com/ClaperCo/Claper

I have it all configured properly, and when I run it, and click on the "login" it performs the oidc challenge (great), but I get an error invalid_request_object, and the params it redirects with are:

?request=<jwt>
&scope=openid+profile+email
&response_type=code
&client_id=my.client.id
&redirect_uri=https%3A%2F%2Fexample.com%2Fusers%2Foidc%2Fcallback

and the JWT decoded looks like:

{
  "alg": "HS256"
}.{
  "aud": "https://myidentityserver.example.com",
  "client_id": "claper.test",
  "exp": 1741370753,
  "iat": 1741370723,
  "iss": "claper.test",
  "jti": "omitted....",
  "nbf": 1741370723,
  "redirect_uri": "https://claper.example.com/users/oidc/callback",
  "response_type": "code",
  "scope": "openid profile email"
}.[Signature]

and in my duende server the error is:

There are no keys available to validate JWT.

Do you know what the problem is?

Reproduction steps

No response

Expected behavior

No response

Logs

No response

Additional context

No response

[RolandGuijt]

Can you please post the client configuration in IdentityServer of my.client.id?

[maldworth]

Any value not posted can be considered empty, or default

Redirect Uri: https://myclaper.example.com/users/oidc/callback
Allowed Scopes: openid, profile, email, roles
Allow offline access: on
Require client secret: on
Grant Type: authorization_code
Require PKCE: false (although I tried with true, but I don't think Claper is using it, so I turned it to false)
Require consent: false

If there's a better way to get the full settings from the db, I can do that if it's more helpful.

[RolandGuijt]

Can you please use a client secret and try again?

[maldworth]

ohh, I do have a client secret, and it's populated. I forgot to mention it above.

[maldworth]

I think I have an easy way to reproduce it locally

docker-compose.yml

services:
  db:
    image: postgres:15
    ports:
      - 5432:5432
    volumes:
      - "claper-db:/var/lib/postgresql/data"
    healthcheck:
      test:
        - CMD
        - pg_isready
        - "-q"
        - "-d"
        - "claper"
        - "-U"
        - "claper"
      retries: 3
      timeout: 5s
    environment:
      POSTGRES_PASSWORD: claper
      POSTGRES_USER: claper
      POSTGRES_DB: claper
    networks:
      - claper-net
  app:
    image: ghcr.io/claperco/claper:latest # or build: .
    ports:
      - 4000:4000
    volumes:
      - "claper-uploads:/app/uploads"
    healthcheck:
      test: curl --fail http://localhost:4000 || exit 1
      retries: 3
      start_period: 20s
      timeout: 5s
    env_file: .env
    depends_on:
      db:
        condition: service_healthy
    networks:
      - claper-net

volumes:
  claper-db:
    driver: local
  claper-uploads:
    driver: local

networks:
  claper-net:
    driver: bridge

.env file

BASE_URL=http://localhost:4000

DATABASE_URL=postgres://claper:claper@db:5432/claper
SECRET_KEY_BASE=0LZiQBLw4WvqPlz4cz8RsHJlxNiSqM9B48y4ChyJ5v1oA0L/TPIqRjQNdPZN3iEG
# Storage configuration

PRESENTATION_STORAGE=local
PRESENTATION_STORAGE_DIR=/app/uploads

# OIDC configuration

OIDC_PROVIDER_NAME="OpenID"
OIDC_ISSUER=https://demo.duendesoftware.com
OIDC_CLIENT_ID=interactive.confidential.nopkce
OIDC_CLIENT_SECRET=secret
OIDC_SCOPES="openid email profile"
OIDC_AUTO_REDIRECT_LOGIN=true

you'll notice I used the demo duende instance. Yes, the redirect_uri wouldn't match, but it doesn't even get that far, so this should be fine to troubleshoot.

So once it starts, go to http://localhost:4000, click "Login" in the top right. And you can see the logs in docker for the claper will have:

** (MatchError) no match of right hand side value: {:error, {:http_error, 400, %{"error" => "invalid_request_object", "error_description" => "Invalid JWT request"}}}

and I believe that's a response from duende

[RolandGuijt]

We tried the Docker container unfortunately coming to the conclusion that your question goes beyond the support we're offering in this discussion forum. We have no idea what calls Claper makes, how OAuth is configured etc. It's basically a black box to us.
I'm suggesting you use Claper support to ask this question. We'll leave the discussion open here should anyone from the community be able to help out.