Social Login for Linkedin plugin unauthorized_scope_error / Empty oauth2 access token
CodeOfConduct opened this issue · comments
Please read the README.md in the repository's root and the support resources before submitting an issue.
Steps to reproduce the issue
- Created and configured App in Linkedin and configured the Social Login plugin for Linkedin as per https://github.com/akeeba/sociallogin/wiki/LinkedIn
- Clicked on button "Sign in with Linkedin" on Joomla login module.
(BTW: I had to install the Linkedin Social Login plugin separately from the unpacked pkg_sociallogin-3.2.2.zip, as the installation of the latter omitted the Linkedin plugin)
Expected result
To be taken to Linkedin Login popup
Actual result
Error displayed:
"Bummer, something went wrong.
In five seconds, you will be redirected to: https://xxxxx/index.php?option=com_ajax&group=sociallogin&plugin=linkedin&format=raw&error=unauthorized_scope_error&error_description=Scope+%26quot%3Br_liteprofile%26quot%3B+is+not+authorized+for+your+application"
(xxxxx is the site's domain)
This error screen is only displayed for a few seconds, before one is taken to the site's home page where the following error is displayed at the top:
"Warning
HTTP 401: {"serviceErrorCode":65604,"message":"Empty oauth2 access token","status":401}"
Troubleshooting already performed
No troubleshooting, but some research:
a) According to https://docs.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?context=linkedin/context published on 16th Nov. 2020: for the Redirect URL: "URL arguments are ignored. For example, https://example.com/?id=1 is the same as https://example.com/." However, in the above-mentioned instructions for the Social Login, the URL does contain a URL argument...
b) For the Linkedin app it says under "OAuth 2.0 scopes": "No permissions added", i.e. r_liteprofile and r_emailaddress are not listed.
c) FWIW, as it is no doubt nothing new: as per https://docs.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin "When requesting an authorization code in Step 2 of the OAuth 2.0 Guide, make sure to request the r_liteprofile and/or r_emailaddress scopes!"
System information
Mandatory information
Issues without this information can not and will not be replied to.
- Joomla! version: 3.9.23
- PHP version: 7.4
- Am I using HTTPS: Yes
- Server Operating System: Linux
- My device's Operating System: Windows
- My device's Operating System version: Win 10 Pro
- Browser: Chrome, Firefox, Edge (Chromium), Chrome
- Browser version: current
Good to have information
You can skip some or all of this information. However, the more information you provide the faster and better we can help.
- MySQL version: x.y.z
- Server type: Apache, NginX, IIS, Lighttpd, LiteSpeed, ...
- Server version: x.y.z
- Hosting company / Local server: Enter the name of your site's hosting company or the prepackaged local server (e.g. MAMP, XAMPP, WAMPServer, ...) that you're using
- Server Operating System version: e.g. Windows 10, Ubuntu 16.04, ... Type N/A if it's a live host and you have no idea.
Additional comments
You can definitely use the LinkedIn plugin with a newly registered application. I just did.
Regarding the URL, it doesn't really matter. Use the URL in the documentation wiki. It still works. What LinkedIn's documentation says is that it doesn't matter if you enter the full URL or just the https://www.example.com/index.php part. That's the part that it validates. The plugin can request a URL with any query string parameters that starts with this protocol, domain and path.
Regarding the scope, we are already requesting r_liteprofile and r_emailaddress. I am not sure why you're making this point?
It sounds like you didn't fully setup your LinkeIn app. You need to go to the Products tab and add Sign In With LinedIn. When the review is complete you will see that the Auth tab at the bottom under OAuth 2.0 Scopes will have r_emailaddress and r_liteprofile. Once you see that you can use the LInkedIn plugin just fine.
PS: I even tried it with a local site, using /etc/hosts to resolve it. It works even in this case!
Thanks a lot for your explanation. After the review had completed and the scopes had been addded, it worked.
Same issue here and the code above resolved it. Will try to get a PR later
@stephenstack The problem in this issue was that the OAuth2 application on LinkedIn's side was not reviewed, therefore it was not yet granted permission to use the OAuth2 scopes required by SocialLogin. There is no code in this issue. The problem was on LinkedIn's side. You will make a PR to what? The code that's already working? I'm confused. Did you mean to comment on a different issue?
Wow, yes, sorry. Ignore or delete..
No worries :)