Hi,
I have a question related to the process of requesting a token described in this article:
Automating authentication with Client Credentials.
If I follow the steps described above I can successfully get a DPoP token to make an authenticated request, but it looks like it’s mandatory to start by the following “login” request:
const response = await fetch('http://localhost:3000/idp/credentials/', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ email: 'my-email@example.com', password: 'my-account-password', name: 'my-token' }),
});
const { id, secret } = await response.json();
If I try to do a user-like login, as described in https://solidproject.org/developers/tutorials/first-app:
await session.login({
oidcIssuer: SOLID_IDENTITY_PROVIDER,
clientName: "Inrupt tutorial client app",
redirectUrl: window.location.href
});
and from the session object I try to use the clientAppId and clientAppSecret values:
let id
let secret
if (session.info.isLoggedIn) {
const sessionInfo = await session.clientAuthentication.getSessionInfo(session.info.sessionId)
console.log(sessionInfo)
id = sessionInfo.clientAppId
secret = sessionInfo.clientAppSecret
}
which looks like this:
{
"sessionId": "83cc23b7-2ead-4aca-a54b-3be8a6dc2f2d",
"webId": "http://localhost:3000/fandroide/profile/card#me",
"isLoggedIn": true,
"redirectUrl": "http://localhost:1234/index.html?state=d7d19dd52b0542b8909d89d139fdbdca",
"issuer": "http://localhost:3000/",
"clientAppId": "hqbqNjaxZ93o5yQuzUfk6",
"clientAppSecret": "m2UoPL8_RJLUfdKJoNUAXyryZwxcu7KBM3E3SVLhKB6BX4GbIYQtKhPjstCsmvwym1nUBDShYzo9k6iL4pmHMQ",
"tokenType": "DPoP"
}
then in the reply I will get a 401 Unauthorized error.
Is this error expected even being the same issuer and user though a different authentication request? Is there any way to get a token, in an automated way, without losing the flow of a user manual login?
Thanks in advance for your time and support!
