question

jason4335 avatar image
jason4335 asked ·

Parameter [prompt] value is invalid

I am attempting integrate a program with Authorization Code Flow using cURL; I use Coldfusion, so I have adapted my code based the documentation, but you should be able to understand the URL variables that I am passing:

<cfhttp   
    
    method="get"
    url=" https://platform.devtest.ringcentral.com/restapi/oauth/authorize";
    resolveurl="yes"
    getasbinary="never"
   
>

<cfhttpparam type="header" name="content-type" value="application/x-www-form-urlencoded">

<cfhttpparam type="url" name="response_type" value="code">
<cfhttpparam type="url" name="client_id" value="#client_id#">
<cfhttpparam type="url" name="redirect_uri" value="#redirect_uri#">
<cfhttpparam type="url" name="state" value="#state#">
<cfhttpparam type="url" name="prompt" value="login">

</cfhttp>

When I execute the code, it processes and displays code that can only execute if the redirect_uri is executed, therefore, the Ringcentral server is forwarding to the redirect_uri.

Here's what my server finds the following variables on dumping variables off of the redirect_uri page:

error: invalid_request 
error_description: Parameter [prompt] value is invalid 
state : ydcm2ud3d2edvLde911nvev9zwvhLiLztzkhh4qmyc6beg44se

1) The only variable that is passed to my redirect_uri page is "state"

2) The error does not make sense.  The prompt variable value is correct.  The documentation says use "login".

I am trying to a response so I can get access token and refresh tokens so I can interact with the API calls.

Please advise....



topic-default
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

anton-nikitin avatar image
anton-nikitin answered ·
Please try using "login consent" pair for now or just do not pass this parameter at all. Our implementation is not 100% compatible with other vendors OAuth implementation, we are fixing it next release.
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

jason4335 avatar image
jason4335 answered ·
I can try removing the parameter and see if that works, but in my experience APIs throw-error when you leave off required parameters.

Also, as an alternative, what do you mean by "use "login consent" pair for now?"
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

anton-nikitin avatar image
anton-nikitin answered ·
"prompt" is not a required parameter, as far as I know. 

I mean specifying "prompt=login%20consent" also helps.
In your example it probably means:

<cfhttpparam type="url" name="prompt" value="login consent">
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

jason4335 avatar image
jason4335 answered ·
Thanks for the help.

Ok. I tried both and I get the same error.  So, I removed it as you suggested and changes happened.


Now, it's redirecting me as follows:


https://www.MYSERVER.com/login/unifiedLogin.html?session=-XXXXXXXXXXXXXX&6597080091492620690&responseType=code&clientId=MYCLIENTID&brandId=BRANDID&state=rct7dor1i5479Le8n2ca4e5xLt3dv0d6kn4hug23nnn3tckua0&localeId=en_US&endpointId=&display=page&prompt=login%20consent%20sso&scope=&appUrlScheme=https%3A%2F%2Fwww.MYDOMAIN.com%2Fsubprocesses%2Fringcentral%2FringCentral_callback.cfm&ui_options=&hideNavigationBar=true

Obviously, it's throwing a 404 error because it's trying to get this path is not on my server.

It appears to be attempting to allow me to login, but for whatever reason it's trying to run the path off of my server.
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

anton-nikitin avatar image
anton-nikitin answered ·
The first request to https://platform. devtest.ringcentral.com should redirect you first to login form which is (if I am not mistaken) is on service.devtest.ringcentral.com or login.devtest.ringcentral.com host. So if you see this kind of redirect it is a correct one - it should bring login form to your browser.
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

jason4335 avatar image
jason4335 answered ·
That's what I thought, but it isn't prompting me with the login form...it's trying to use the path off my server as opposed to Ringcentral's server.  I know this process works, because I have authorization working on Google's API...


Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

anton-nikitin avatar image
anton-nikitin answered ·
This is pretty strange. Looks that some party intercepts the redirect and substitutes the host name with your server name.  Actually authorization code flow should be initiated from browser JS in your case to work properly (since you suppose to get a redirect directly to browser). If this first call is actually initiated by your backend it will not work (unless your backend passes the full redirect URI to a browser client somehow).
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

jason4335 avatar image
jason4335 answered ·
I am initiating it from my backend server. That website domain is my website that is being replaced.


I know with Google Authorization Flow, it brings up Google's page, I login, it passes it to my redirect URI which grabs the access tokens and refresh tokens from the JSON string that is passed and I am on my way.  It should work the same....

Are you saying you can't initiate the authorization flow from the backend (I know others have with PHP which means CF should be able to do it) or are you saying in my case I must use JS?  I would like to avoid JS.

When you say my backend must pass the full redirect URI to the browser client, I am not following you....I can pretty much do anything with CF, but if you are saying that the authorization flow must be on the client side, then it can't be done.

Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Tyler Liu avatar image
Tyler Liu answered ·
I am not sure the process is correct. Please read the 4-steps guide here:  https://github.com/tylerlong/ringcentral-python#authorization-code-flow-3-legged-authorization-flow

So for step #1, what is the uri in your case?
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

jason4335 avatar image
jason4335 answered ·
It's here and defined above in code like this:

<cfset redirect_uri = " MYREDIRECTURI.com" />

<cfhttpparam type="url" name="redirect_uri" value="#redirect_uri#">

I don't think that's the issue....
Share
1 |1000 characters needed characters left characters exceeded

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.