We have two ISV instances, one for staging and another one for production, sitting on different IBM Cloud accounts. For some unknown reason, we're seeing different authentication sequences between them, one works the other doesn't.

The one that does not work goes through the following sequence:

URL: https://idaas.ice.ibmcloud.com/idaas/mtfim/sps/idaas/login/ibmid/authorize?scope=openid&response_type=code&state=20221222-801b872e-ca98-4f0d-9fcd-3819427fbeb2-fe032&redirect_uri=https%3A%2F%2Fidaas.ice.ibmcloud.com%2Fidaas%2Fmtfim%2Fsps%2Fidaas%2Flogin%2Fibmid%2Fcallback&client_id=ISVProdClient1
URL: https://login.ibm.com/v1.0/endpoint/default/authorize?scope=openid&response_type=code&state=20221222-801b872e-ca98-4f0d-9fcd-3819427fbeb2-fe032&redirect_uri=https%3A%2F%2Fidaas.ice.ibmcloud.com%2Fidaas%2Fmtfim%2Fsps%2Fidaas%2Flogin%2Fibmid%2Fredirect&client_id=ISVProdClient1
URL: https://idaas.ice.ibmcloud.com/idaas/mtfim/sps/idaas/login/ibmid/redirect?code=RKXqPshevl3xW5mSjnNZw1fDCPHM7M&grant_id=e5511ee9-10a0-4859-aa5a-607701ae76cb&state=20221222-801b872e-ca98-4f0d-9fcd-3819427fbeb2-fe032
URL: https://mcm-prod.verify.ibm.com/idaas/mtfim/sps/idaas/login/ibmid/callback?code=RKXqPshevl3xW5mSjnNZw1fDCPHM7M&scope=openid&state=20221222-801b872e-ca98-4f0d-9fcd-3819427fbeb2-fe032&redirect_uri=https%3A%2F%2Fmcm-prod.verify.ibm.com%2Fidaas%2Fmtfim%2Fsps%2Fidaas%2Flogin%2Fibmid%2Fcallback&client_id=ISVProdClient1
URL: https://mcm-prod.verify.ibm.com/oidc/endpoint/default/authorize?qsId=9ce75ba6-cc0d-4ec9-9de9-ee5beaea7aab&client_id=0561247b-6991-4f0f-a6eb-1a9b71bb2d34&identity_source_id=5d788d24-59e0-4e7a-a86e-9de2791998dc
URL: https://app.multicloudmesh.ibm.com/api/v1/callback/?error_description=CSIAQ0147E+The+required+parameter%3A+%5Bcode_challenge%5D+is+missing+in+the+request.&state=gg_eGTY_c9l_ZZEMFdGLXg&error=invalid_request
URL: https://app.multicloudmesh.ibm.com/api/v1/callback?error_description=CSIAQ0147E+The+required+parameter%3A+%5Bcode_challenge%5D+is+missing+in+the+request.&state=gg_eGTY_c9l_ZZEMFdGLXg&error=invalid_request
Status: 200 OK
Source: Network
​

See the error in the last redirects? Any clue as to why are we receiving that error?

------------------------------
Javier Araúz
------------------------------

Hi Javier,

The error message

CSIAQ0147E+The+required+parameter%3A+%5Bcode_challenge%5D+is+missing+in+the+request​

is related to PKCE.

It seems that the client is not configured to use PKCE when sending the initial request to the IDP (the call to /authorize)

------------------------------
André Leruitte
------------------------------

Yes, that was the problem! After enabling it, authentication works. Thanks a lot!

------------------------------
Javier Araúz
------------------------------

Original Message:
Sent: Tue December 27, 2022 04:22 AM
From: André Leruitte
Subject: Failing authentication with IBMid: missing [code_challenge] error in redirect URL

Hi Javier,

The error message

CSIAQ0147E+The+required+parameter%3A+%5Bcode_challenge%5D+is+missing+in+the+request​

is related to PKCE.

It seems that the client is not configured to use PKCE when sending the initial request to the IDP (the call to /authorize)

------------------------------
André Leruitte
------------------------------