Oauth2 issue with ADFS 4.0 about stf

[denis99999]

@cert-x your configuration seems correct althrough I am not sure your ca-certificates is required (i.e. try to drop it), perhaps your STF server (resource server) is not able to reach the ADFS server (OAuth server) during the token validation step due to a missing firewall rule, you should take a network trace to see exactly what is happened.

[sn00wden]

@denis99999 thank you.
I'm able to reach adfs, then get authorize page, then receive token and get to the callback url page...with this error.
If I do not use ca-sertificates, I get next err:

TokenError: MSIS9612: The authorization code received in 'code' parameter is invalid. 
    at Strategy.OAuth2Strategy.parseErrorResponse (/app/node_modules/passport-oauth2/lib/strategy.js:373:12)
    at Strategy.OAuth2Strategy._createOAuthError (/app/node_modules/passport-oauth2/lib/strategy.js:420:16)
    at /app/node_modules/passport-oauth2/lib/strategy.js:177:45
    at /app/node_modules/oauth/lib/oauth2.js:191:18
    at passBackControl (/app/node_modules/oauth/lib/oauth2.js:132:9)
    at IncomingMessage.<anonymous> (/app/node_modules/oauth/lib/oauth2.js:157:7)
    at IncomingMessage.emit (node:events:539:35)
    at endReadableNT (node:internal/streams/readable:1345:12)
    at processTicksAndRejections (node:internal/process/task_queues:83:21)

But googling gives nothing, causer we have 1 node ADFS and SQL Server

[denis99999]

@cert-x it seems the code returned is invalid, you should request to ADFS support because it does not seem an issue from STF but between your resource server and the oAuth server (i.e. you should take a full network trace to identify that), sorry I am not able to help you anymore on that issue, what I can say is that it works well in my side using either oAuth 2.0 or SAML 2.0 protocols in front of my company Authentication servers.

[sn00wden]

@denis99999, hello!
What names of claims should we get from ADFS?

[denis99999]

@cert-x, I don't really understand your question, I don't know ADFS but what I understand is that ADFS is the authentication server that issued you an Oauth 2.0 partnership for ADFS, so if it does not work with STF, I suggest you contact the ADFS support team to verify your Oauth 2.0 partnership for ADFS and test it using a 3rd party baseline tool, I know some people use Postman for this!