Unable to Link Your Skill - Authorization Code Grant - {"message":null}

Did you ever get this configured with IdentityServer? I am trying the same with IdentityServer4 and having similar results.

Could have to do with how your chain is set up. Investigating...

I hooked it up to the CloudFromation Proxy thing and got the message: "Execution failed due to configuration error: General SSLEngine problem".

After looking at the Root CA of our Oauth Server (DigiCert Global Root CA) and its serial number, we compared it to the list found at https://mozillacaprogram.secure.force.com/CA/IncludedCACertificateReport. I searched for both DigiCert Global Root CA and the serial number of the root and it is in there.

Can someone please explain why this issue would occur if our root ca is in the list

We believe that we get the 500 internal server error / message: null because we were not using the alexa app/pitangui.amazon.com to get the code. that error came when we made a request to the auth endpoint with the amazon redirect uri straight in chrome.

However, when using pitangui.amazon.com and click link account and do the login, our auth server is successfully redirecting to the amazon redirect uri with a code, state, and session_state. the state is the same that was issued by amazon initially. then the next redirect is to "unable to link account". When it is done like this, there is no 500 error.

Brian,

Thanks for the response. Auth Code Response is chosen in the alexa configuration as well as the flow in our IdentityServer. From our logs, it looks like there is a request to our authorization endpoint but not a request to the token endpoint. The request to the auth endpoint seems to be working fine.

We tried auhtorizing and getting a token in postman and can verify that it works. We made a request to the auth server and gave postmans callback uri and copied the code it returned and made a post request to our token endpoint in postman using basic authentication and the code, redirect_uri, and grant_type in the request body. If you would like me to provide logs, let me know an I can send them over. We have logs trying to link in alexa app, on chrome using pitangui.amazon.com and from postman using postman callback (example of success). I started a case last week (4177062801) that has the relevant information but i will repost here.

• Skill ID: amzn1.ask.skill.83a26cc8-f03b-4a5f-b3e9-ef7494477e1d
• Region(s) you're trying to link with: (EU/NA?): USA (NA)
• Device/Type platform (Android/iOS/Browser): iOS, windows chrome, mac chrome
• Version of AlexaApp (Under settings -> about the alexa app): 1.24.2329.0
• Screenshot/description of issue (empty page? Seeing 'Unable to link' page? Button on page not functioning?): Unable to link your Bruin Skill; {"message": null}; 500 Internal Server Error
• Exact time and date(in UTC, or with time zone) you tried and failed to link the skill: There are a lot but one is 2017-07-25 10:54:41.0165 and another is 2017-07-25 10:51:45.8912. I chose these two times because the first seems different than the others and occurs when I try to account link after i havent done so in a while but the second time is an example of what they normally look like.

And from skill setup in the developer portal page:

• AuthorizationUrl: https://id.bruin.com/identity/connect/authorize
• Token Endpoint: https://id.bruin.com/identity/connect/token
• Whitelisted Domains: id.bruin.com
• AccountLinkingType (Implicit Grant or AuthCode): AuthCode

Generally this message: null error happens when you are trying to use auth, but have implicit selected. Can you make sure these two match? Then look at our debug guide: https://forums.developer.amazon.com/articles/38610/alexa-debugging-account-linking.html

If neither of these resources solve your problem, post here with the information outlined in the account linking debug guide.

UPDATE:

I was getting invalid scope because the OAuth Framework I am using only supports Implicit Grant Flow when requesting resources, not user information. I need to link to get user information so I am not going to be able to use Implicit Grant flow in my case.

Any help getting Auth Code working would be great

update: also tried implicit grant and when it redirects, one of the query params is error=invalid_scope.

I am just using openid and profile as my scopes and have tested just trying to use one at a time but got same issue. the identity server that i am connecting to has those scopes on and supported