User toker not authorized about fiware-pep-proxy HOT 5 CLOSED

Hi,

Check that the 'pepproxy' user exists in Keystone. If I recall correctly, the default installation won't create any user for the PEP Proxy to use, you have to create one yourself.

If you are using the last version of the IdM, I added an option in the application detail page to automatically register a PEP Proxy for your application. You can find it right over the OAuth2.0 Credentials panel.

Let me know if this solves the issue.
Cheers,
Enrique

from fiware-pep-proxy.

Hi Enrique,

pepproxy exists in Keystone, see below

| pepproxy | pepproxy | {"username": "pepproxy", "description": "pepproxy", "email": "[email protected]"} | $6$rounds=40000$uH4kerx8dq5Mar6G$FxjngArx2Fgj5eRJI.FJcqcdqPio8dtC7M8FM5oU1x/e1BB/pZSKEaOW3Y0NArruRnhVVSIS8WXdrC6G4.oSi/ | 1 | default | 529e3c7b3e364f8c8c59d331a8a75b58 |

And in IDM appears this as a PEP Proxy, should I remove it? I guess this is a default PEP

Thanks

from fiware-pep-proxy.

I guess you can use any of the two pepproxy users. I would use the one created in the application page, as is the new intended behaviour, but thats up to you.

Can you successfully authenticate against Keystone with the configured PEP Proxy user? It looks like this is working fine, but just to be sure.

Another possible mistake is that you might be using a Keystone token when you have the 'oauth2' token engine configured. Make sure the token you are using to authenticate your call against the PEP Proxy is the OAuth2.0 token provided ("access_token": "0xDy1ebB13V1VNJ35boJkBdjxwrmgE"). It can be tricky to work with the two types of tokens and is easy to mix them.

As a side note, be careful not to accidentally reveal your OAuth2.0 secret! As you are running in localhost I don't think there is any problem but be careful ;)

Cheers,
Enrique

from fiware-pep-proxy.

Thanks Enrique. I guess what the mistake is. I was using refresh_token not access_token.

By the way, what is the purpose of refresh_token?

Thanks for your help

from fiware-pep-proxy.

Refresh token is a long lasting credential that allows you to obtain a new access token once the first one is expired with out needing to go through the whole OAuth2.0 flow again. It has a validity of around 2 weeks and once used to obtain a new access token is invalidated. You should keep it secret ;)

I'm glad its working, I'll close the issue then.
Best regards,
Enrique

from fiware-pep-proxy.