Receiving authorization errors for some users of our app

Question

question

DavidN asked · Jul 28, 2016 at 03:12 PM

Receiving authorization errors for some users of our app

We have an Android app - currently in beta - that integrates with the Alexa voice service. We use the Login With Amazon SDK to authorize users and retrieve an access token. A few of our users are getting strange results during the authorization process after they enter their Amazon login information. As required by the Login With Amazon SDK, we create an instance of AuthorizeListener. The onError() method of this is called, and the result of AuthError.getMessage() is one of the following:

Unauthorizaied Client. The authenticated client is not authorized to use this authorization grant type. {"error_description":"Not authorized for requested operation","error":"unauthorized_client"}
Error=access_denied error_description=User not authenticated
Service Failure

Can someone describe what, exactly, these error messages mean? I do not believe there is a bug in our code, since the majority of users are able to login successfully. So, I assume this is an issue with the user's account or their device.

alexa voice service account linking android account information

0

10 |2000 characters needed characters left characters exceeded

Attachments: Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

3 Answers

Answer 1 · 2016-08-11T22:48:32Z

swasey@amazon answered · Aug 11, 2016 at 10:48 PM · ACCEPTED ANSWER

Hi David, sorry for the delay. I finally got information from the LWA folks. Their response is below. The Unauthorized Client failures is the only ones that look like there's anything you might be doing wrong. What method of getting tokens are you using? When you create your bundle to pass to the authorize() method, are you adding CODE_CHALLENGE and GET_AUTH, or only SCOPE_DATA?

What percentage of your users do you see running into these issues?

Their response:

Unauthorized Client This error is caused by authorization code to token exchange failed. There are multiple reasons that could cause this error:

Invalid clientID. The clientID provided by the developer on the forum post is their website's clientID. When using AVS through their mobile companion app, they'll need to do code to token exchange with their mobile clientID, which is only accessible through calling the getClientId() API.
Invalid code verifier. The code to token exchange requires a valid code verifier that used to generate the code challenge when making the authorize() call. If the code verifier is invalid, it will result in unauthorized_client error.

access_denied

This is generally caused by user clicked on the 'back' button on either the 1p webview or browser that cancelled the LWA flow

Service Failure

This is caused by the SDK not being able to communicate the the SSO component in mShop app. This most likely happens on some legacy 1p device or 3p device with outdated mShop app installed. LWA has made best effort to support backwards compatibility in a way that if our SDK detects an outdated SSO component on the device, the SDK will ignore it and opens up LWA flow in the browser, however, due to the amount of legacy devices and various old versions of mShop app out there in the market, there will most likely still be legacy devices that sees this failure. The only way to debug this issue is to get the exact device type/Android version/mShop version for the error device.

0 · Show 4 · Share

10 |2000 characters needed characters left characters exceeded

Attachments: Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

DavidN · Aug 14, 2016 at 01:10 AM

Thanks for the information. I'm not able to provide an exact percentage, but I can safely say that the number of times an error occurs is less than 5%.

When creating the Bundle to pass to AmazonAuthorizationManager.authorize(), we just use scope data. Here's a code sample:

_authManager = new AmazonAuthorizationManager(this, Bundle.EMPTY);
String scopeData = "{\"alexa:all\":{\"productID\":\"Ultimate_Driving_Mode\", \"productInstanceAttributes\":{\"deviceSerialNumber\":\"123456\"}}}";
Bundle options = new Bundle();
options.putString(AuthzConstants.BUNDLE_KEY.SCOPE_DATA.val, scopeData);
_authManager.authorize(new String[]{"alexa:all"}, options, new AuthorizeListener());

Here, the AuthorizeListener class is an implementation of AuthorizationListener, with onSuccess(), onError(), and onCancel() methods.

Regarding the "Unauthorized Client" error, this has not occurred in over 2 weeks. If it continues to be absent, then there is no need to investigate further.

Regarding the "access_denied" error, are you saying that this can occur if the user presses Android's back button while on the screen that asks for the Amazon username and password? I tried this on a test device, and the problem was not reproduced.

Regarding the "Service Failure" error, can you explain what you mean by "mShop app", "1p device", and "3p device"? We have seen the problem on Android version 5 and 6, and on a variety of models. This error is the most common of the three.

Also, please be aware that I ran into a significant bug in the forum itself. I tried to submit this message before and, after clicking on the "Post Answer" button, the message was not actually posted. This has forced me to type this message again from the beginning.

0 · Share ·

Eric@Amazon DavidN · Aug 15, 2016 at 09:51 PM

mShop app = The internal name for the Amazon shopping app. Sorry for the confusion.

1p device = a device made by Amazon (ex. Echo, Tap, etc.)

3p device = a device made by people external to Amazon

Yes, you have the correct understanding for the access_denied error. What behaviour are you seeing?

Sorry about our forum! It's new and we're still working out the kinks.

0 · Share ·

DavidN Eric@Amazon · Aug 17, 2016 at 11:20 PM

Thanks for the information. For the "Service Failure" error, we will go ahead and ask the user to upgrade their Amazon shopping app to the latest version.

For the "access_denied" error, we haven't been able to reproduce the error on our test devices (by pressing the back button or by any other means). It's only showing up in our error logs for end users. All of our test devices have the Amazon Shopping app installed, and this app is blocked from being removed. After pressing the Back button, AuthorizationListener.onCancel() is called. Could this error potentially occur only on devices that do not have the Amazon Shopping app installed, after the user presses the back button?

0 · Share ·

Show more comments

Answer 2 · 2019-03-14T15:22:13Z

NewUser-56f65031-ecae-4b0e-b555-f413c29211cd answered · Mar 14, 2019 at 03:22 PM

Hi, I've been facing the same issue. I have an Android app using the LWA SDK and for a long time it worked fine but suddenly it started getting that error:

Error=access_denied error_description=User not authenticated

I managed to make it work by going to a browser and signing out of the account. After that when I tried LWA again it signed in normally, which makes me think maybe it's an issue related to an expired session?

The issue hasn't happened again, but I'm still concerned it could eventually happen to a user. Could you check to see if there's a solution for that problem, even if it's something we could do on our side?

Thanks

0 · Share

10 |2000 characters needed characters left characters exceeded

Attachments: Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

Answer 3 · 2016-07-29T20:04:34Z

swasey@amazon answered · Jul 29, 2016 at 08:04 PM

Hmm, I've never heard of this before. Are all the users affected perhaps using non-amazon.com accounts? For example, amazon.co.uk, or amazon.de, etc? I'll reach out to the LWA team for help, but if you could provide your client_id (in your LWA settings on the developer console) that'd be useful. Please do NOT provide your client_secret or APIKey.

0 · Show 1 · Share

10 |2000 characters needed characters left characters exceeded

Attachments: Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

DavidN · Jul 29, 2016 at 08:43 PM

Thanks. Our client_id is amzn1.application-oa2-client.77c2c8a9b67a4f7985f8e49d53f42a32.

Since the app has users from English speaking countries around the world, such as the UK and Australia, it is definitely possible that some people are signing in with accounts on amazon.co.uk and others. Our error logs do not show the user's country, however, so I can't confirm that these are occurring for non-US customers.

If it helps, here are some recent occurrences of each error. All times are US central:

Unauthorized Client: 2016-07-28 04:17:35, 2016-07-28 04:15:38, 2016-07-27 19:09:51

Error=access_denied: 2016-07-27 15:34:08

Service Failure: 2016-07-27 19:06:13, 2016-07-27 18:21:20

0 · Share ·

Receiving authorization errors for some users of our app

question details

Related Questions