Handle denial, rejection and a lost response, then run the complete exchange

Setup

1. In a fresh terminal, set the lab-printer variables and API_ID and API_SECRET for lab-photo-api. Define start_attempt, handle_callback and redeem exactly as in the Correlating requests and responses lab.

2. In Access Token Management, create a temporary manager lab-tmp-deny-ben (Signed JWT, an active key) with this advanced issuance policy, and save it without assigning it.

return {allow: context.subject.email !== '[email protected]', claims: {}};

3. Press Start on this page.

Walkthrough

1. Denied at the authorization server. Run start_attempt, sign in as Ava and choose Deny. The callback carries error=access_denied, error_description=The user denied the request., state and iss. Pass them to handle_callback: it validates state and iss, then reports "not connected".

Why it matters: an error response does not bypass the transaction and issuer checks. No code was issued, so no token request follows, and the printer can say "The photo account was not connected. You can continue without it or try again."

2. Refused by policy, not by a person. Open OAuth > Clients > lab-printer, set Access token manager to lab-tmp-deny-ben and save. Run start_attempt, add &prompt=login to the address, sign in as Ben and approve. The callback succeeds and handle_callback accepts it, but redeem answers invalid_grant, "The tenant's access token policy refused to issue this token."

Why it matters: a refusal does not always mean someone clicked Cancel. In this tenant a code-flow policy refusal arrives at the token endpoint; in the implicit grant lab the same kind of refusal arrives at the callback as access_denied.

Restore: in OAuth > Clients > lab-printer, set Access token manager back to Default access tokens and save.

3. No callback at all. Run start_attempt, then open the address with your redirect URI changed by one character, for example a missing trailing slash. The tenant shows its own error page and the printer never hears back. Its pending attempt simply ages out.

4. Rejected at the token endpoint. Compare the status codes, then capture a request ID.

   • A wrong secret: curl -s -i -u "$CLIENT_ID:not-the-secret-not-the-secret-not-the-secret" -d grant_type=authorization_code -d code=x -d redirect_uri=x "$ISSUER/oauth/token" gives 401 invalid_client.

   • A missing code: the request below gives 400 invalid_request.

   • A mismatched verifier gives 400 invalid_grant, as in the PKCE lab.

curl -s -D - -o /dev/null -u "$CLIENT_ID:$CLIENT_SECRET" -d grant_type=authorization_code "$ISSUER/oauth/token" | grep -i x-request-id

Search Audit or Logs for that request ID: it is the oauth.token rejected invalid_request event for lab-printer.

Why it matters: the printer records the stage, a correlation ID and a safe error category, never the code, verifier or Authorization header. error_description is untrusted text: display it as text, never as markup.

5. A lost response. Get a code with start_attempt and handle_callback, then exchange it but keep the answer out of sight, as if it never arrived.

Simulation. only the dropped connection is simulated, by not reading the response. The exchange, the issued token, the retry and the revocation are all real.

LOST=$(curl -s -u "$CLIENT_ID:$CLIENT_SECRET" -d grant_type=authorization_code -d "code=$CODE" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" -d "code_verifier=$VERIFIER" "$ISSUER/oauth/token")
redeem   # the "retry" with the same code

The retry answers invalid_grant, "The authorization code was already used. Tokens issued from it have been revoked." Now look at the token the printer never saw: btl-lab introspect "$(echo "$LOST" | jq -r .access_token)" returns {"active": false}.

Why it matters: a timeout is not a confirmed failure, and resending a code cannot recover it. A second presentation looks like a stolen code, so the server revokes what it issued. The printer reports that the connection did not finish and offers a fresh attempt.

6. The complete exchange, with every check in place, in the same terminal.

   1. start_attempt, open the address, sign in as Ava and approve.

   2. handle_callback "<state>" "<iss>" "<code>": session-bound state, expected iss, claimed once.

   3. redeem: the printer's secret, the same redirect_uri and this attempt's verifier. Keep the token in memory only: read -r TOKEN.

   4. Read scope and expires_in from the response.

   5. Use the token at the API: btl-lab introspect "$TOKEN".

   6. Move on from the callback page without saving its address anywhere.

Compare the Audit chain with the one you labeled in the Following the complete exchange lab: request_started, sign-in or an existing session, code_issued, oauth.token succeeded, then oauth.introspect by lab-photo-api.

Break it

Steps 2 to 5 are the deliberate failures. The only setting changed, in step 2, is restored in the same step.

Check your work

Press Check my progress. Logs also has oauth.authorize rejected invalid_redirect_uri for step 3, which never reached the printer.

Cleanup

1. Confirm lab-printer uses Default access tokens, then delete the lab-tmp-deny-ben manager.