manfredsteyer / angular-oauth2-oidc

Support for OAuth 2 and OpenId Connect (OIDC) in Angular.
MIT License
1.86k stars 681 forks source link

Unauthorized (access_denied) User Redirected back to App, but unhandled by the OIDC plugin #1377

Open kraighamady opened 6 months ago

kraighamady commented 6 months ago

Describe the bug When a user logs into the OIDC provider but access is denied (Okta in this case, where the user was not assigned to the app in question), Okta redirects back to my app and appends the following parameters to the URL:

?error=access_denied&error_description=User+is+not+assigned+to+the+client+application.

This is unhandled by the plugin and I get errors in the console that show that the plugin is intercepting the error, but not doing anything but logging to console. Console Output (cleaned up for clarity):

error trying to login [angular-oauth2-oidc.mjs:1104:24](http://localhost:4200/node_modules/angular-oauth2-oidc/fesm2020/angular-oauth2-oidc.mjs)

ERROR Error: Uncaught (in promise): OAuthErrorEvent: {"type":"code_error","reason":{},"params":{"error":"access_denied","error_description":"User+is+not+assigned+to+the+client+application."}}

ERROR Error: Uncaught (in promise): OAuthErrorEvent: {"type":"code_error","reason":{},"params":{"error":"access_denied","error_description":"User+is+not+assigned+to+the+client+application."}}

How do I access this error handling to redirect to an error page on my app? I did find the section on interceptors in the docs, but the examples didn't help me to understand how to tap into this process.

Notes: I am using CodeFlow with PKCE. All other login functions are working

To Reproduce Steps to reproduce the behavior:

  1. Login with a user that has not been assigned to your application (with an Okta OIDC provider)
  2. You should see your app redirected back with the same parameters appended to the URL (the redirect URI specified in your config
  3. Check console for the same errors I posted above.

Expected behavior Was expecting more than just a blank screen.

Desktop (please complete the following information):