Hi Guys,

I have a SPA that uses OIDC + PKCE for authentication.

When the user comes to the site, after determining that the user is not signed in, we redirect them to ISV using the following code:

let chall = RANDOM_STRING_METHOD(64);

crypto.subtle.digest("SHA-256", new TextEncoder().encode(chall))
.then(resp =>
    {
        return btoa(String.fromCharCode(...new Uint8Array(resp))).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
    })
.then(resp =>
    {
        let isv = `https://bigblue.verify.ibm.com/v1.0/endpoint/default/authorize`
                + `?client_id=XXXXXX`
                + `&redirect_uri=https://my.apps.domain.dev/auth/isv/code`
                + `&response_type=code`
                + `&code_challenge=${resp}`
                + `&code_challenge_method=S256`
                + `&scope=openid profile email`;

        window.location.replace(isv);
    });​

After authenticating in ISV, we're redirected back to `https://my.apps.domain.dev/auth/isv/code` with a `code` and `grant_id` in the query string. We then construct the token request using the following. Note `cv` is the original challenge generated above.

let furl = `https://bigblue.verify.ibm.com/v1.0/endpoint/default/token`;
var x = new URLSearchParams({
    client_id: "XXXXXX",
    code_verifier: cv,
    grant_type: "authorization_code",
    redirect_uri: `https://my.apps.domain.dev/auth/isv/token`,
    code: code
});

fetch(furl, {
    "method": "POST",
    "body": x
})
.then(resp => resp.json())
.then(resp =>
    {
        console.log("SUCCESS", resp);
    })
.catch(resp => 
    {
        console.error("ERROR", resp);
    });​

What's strange is the response I'm getting from ISV. I get an error saying:

{error_description: 'CSIAQ0160E The client secret is missing.', error: 'invalid_client'}​

I have confirmed that the `client_id` is correct. I've also confirmed that I am including the `challenge_verifier` in the token request.

What am I doing wrong here?

------------------------------
Timothy
------------------------------

OK. So I went into the Applications > Applications area in the IBM Security Verify Admin portal (i.e. https://contoso.verify.ibm.com/ui/admin), found the application and selected Public Client (no client secret). After that, the authorisation flow worked perfectly, without any code changes.

Then, using the API Access tab I am creating the Client ID/Client Secret credentials needed for the backend OAuth-protected API related to this SPA.

------------------------------
Timothy
------------------------------