Stuck on an issue?

What version of UAA are you running?

UAA 4.10.0

What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json' {“app”:{“version”:“4.10.0”},“showLoginLinks”:true,“links”:{“uaa”:“http://localhost:8080/uaa",“passwd”:“/forgot_password”,“login”:"http://loc alhost:8080/uaa”,“register”:“/create_account”},“zone_name”:“uaa”,“entityID”:“uaa-8080-saml”,“commit_id”:“a4132cb”,“idpDefinitions”:{},“prompts”:{“username”:[“text”,“Email”],“password”:[“password”,“Password”],“passcode”:[“password”,“One Time Code ( Get one at http://localhost:8080/uaa/passcode )”]},“timestamp”:“2018-02-06T18:24:36+0000”}

How are you deploying the UAA?

I am deploying the UAA

• As a war file downloaded from Maven repository.

What did you do?

I am trying to setup Github as an external Oauth2 identity provider with the UAA. Here is what I did:

1. Created a new Oauth app at: https://github.com/settings/applications/new
2. Configure UAA to setup github as external Oauth2 IDP with the below configuration in the uaa.yml login: oauth: providers: github: type: oauth2.0 authUrl: https://github.com/login/oauth/authorize tokenUrl: https://github.com/login/oauth/access_token userInfoUrl: https://api.github.com/user scopes: - openid - email linkText: Login with Github showLinkText: true addShadowUserOnLogin: true relyingPartyId: $My-clientId relyingPartySecret: $My-clientSecret skipSslValidation: true clientAuthInBody: true attributeMappings: user_name: email

What did you expect to see? What goal are you trying to achieve with the UAA?

I want to be logged in via an external Oauth2 IDP configured in UAA. When I go to the UAA I see the link ‘Login with Github’. After clicking the link I am redirected to the Github. After successful login in Github I expect to be logged in the UAA.

What did you see instead?

After successfully login in the Guthub I am redirected back to UAA with the below message: “There was an error when authenticating against the external identity provider: NullPointerException”

Please include UAA logs if available. [2018-04-03 10:21:27.186] cloudfoundry-identity-server - ??? [http-apr-8080-exec-6] … ERROR — XOAuthAuthenticationFilter: XOauth Authentication exception java.lang.NullPointerException at org.cloudfoundry.identity.uaa.login.AccountSavingAuthenticationSuccessHandler.setSavedAccountOptio nCookie(AccountSavingAuthenticationSuccessHandler.java:52) at org.cloudfoundry.identity.uaa.provider.oauth.XOAuthAuthenticationFilter.lambda$authenticationWasSu ccessful$0(XOAuthAuthenticationFilter.java:94) at java.util.Optional.ifPresent(Optional.java:159) at org.cloudfoundry.identity.uaa.provider.oauth.XOAuthAuthenticationFilter.authenticationWasSuccessfu l(XOAuthAuthenticationFilter.java:93) at org.cloudfoundry.identity.uaa.provider.oauth.XOAuthAuthenticationFilter.doFilter(XOAuthAuthenticat ionFilter.java:59) at

Here is my analysis so far: Below is the request and response from UAA to acquire access token from Github: Request: https://github.com/login/oauth/access_token Parameters: grant_type=authorization_code&response_type=token&code=72a22a2d404f6061aa2f&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fuaa%2Flogin%2Fcallback%2Fgithub&client_id=$My-clientId&client_secret=$My-clientSecret

Response: {access_token=I-get-here-valid-access-token, token_type=bearer, scope=}

At this point UAA tries to fetch ‘access_token’ from the response here: https://github.com/cloudfoundry/uaa/blob/4.10.0/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/XOAuthAuthenticationManager.java#L569

But it seems the method getResponseType returns as ‘token’ instead of ‘access_token’ and hence it fails. Please see below: https://github.com/cloudfoundry/uaa/blob/4.10.0/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/XOAuthAuthenticationManager.java#L389