Always getting Access denied error

[auth0]

Always getting Access denied error

[cocojoe]

Hi @SanjoDeundiak I suggest you work through the QuickStart guide to get started.

https://auth0.com/docs/quickstart/native/ios-swift/getting-started

[SanjoDeundiak]

@cocojoe I've seen this guide, and I'm using it from Dashboard where I was able to download finished example with my API details already filled.

[cocojoe]

Downloading it is one thing, but it's worth reading through as there are also manual steps such as setting up your callback. Generally if it doesn't work it's a case of double checking all of the steps.

[SanjoDeundiak]

@cocojoe I've checked the tutorial. callback is setup correctly, otherwise I would see HTML with description that I should add this callback to the list of allowed callbacks (which I did). I hope that my error does really mean something and you can point where mistake can align more precisely than just "Check tutorial one more time"

[cocojoe]

Access Denied infers the resource owner has denied access, so double checking setup is a good first sanity check, if you may have multiple clients it's worth checking that Auth0.plist has the credentials you expect.
If you have done this then I would add some logging so you can see what calls are being made that would aid in understanding what is happening with the client<>server API flow.

https://github.com/auth0/auth0.swift#logging

Also please supply the code you are using to produce this error. So I can reproduce it.

Thanks

[SanjoDeundiak]

@cocojoe Credentials do match. Source code is pretty much the same as one in the sample.

@IBAction func showLoginController(_ sender: UIButton) {
    guard let clientInfo = plistValues(bundle: Bundle.main) else { return }
    var auth = Auth0.webAuth()
    auth
        .logging(enabled: true)
        .scope("openid profile")
        .audience("https://" + clientInfo.domain + "/userinfo")
        .start {
            switch $0 {
            case .failure(let error):
                print("Error: \(error)")
            case .success(let credentials):
                guard let accessToken = credentials.accessToken else { return }
                self.showSuccessAlert(accessToken)
            }
    }
}

Here are log messages for sign-up + sign in

2018-01-09 20:03:58.375563+0200 Auth0Sample[4957:396599] Simulator user has requested new graphics quality: 10
Safari: https://sanjo.eu.auth0.com/authorize?state=zLLQME1wz-p6dqFjcA-OJYhnt_hKrlTZep8xIxEAiIE&response_type=code&redirect_uri=auth0.samples.Auth0Sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback&client_id=ZQxpWut8dTXdHCNvBm9OvOZ32kEPLCW0&audience=https://sanjo.eu.auth0.com/userinfo&code_challenge=dN0JxWL8HFcTctjZAmjO-aHU_IYpWmTDbN3-LE2jTME&code_challenge_method=S256&scope=openid%20profile&auth0Client=eyJuYW1lIjoiQXV0aDAuc3dpZnQiLCJ2ZXJzaW9uIjoiMS44LjAiLCJzd2lmdC12ZXJzaW9uIjoiMy4wIn0
2018-01-09 20:04:03.201399+0200 Auth0Sample[4957:396599] [MC] System group container for systemgroup.com.apple.configurationprofiles path is /Users/sanjo/Library/Developer/CoreSimulator/Devices/0BA302D1-73E6-4A3D-846D-53E853DA2DDE/data/Containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles
2018-01-09 20:04:03.202301+0200 Auth0Sample[4957:396599] [MC] Reading from private effective user settings.
2018-01-09 20:04:03.240841+0200 Auth0Sample[4957:396599] [App] if we're in the real pre-commit handler we can't actually add any new fences due to CA restriction
2018-01-09 20:04:18.133186+0200 Auth0Sample[4957:396599] [App] if we're in the real pre-commit handler we can't actually add any new fences due to CA restriction
iOS Safari: auth0.samples.auth0sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback?error=unauthorized&error_description=Access%20denied.&state=zLLQME1wz-p6dqFjcA-OJYhnt_hKrlTZep8xIxEAiIE
Error: Access denied.
Safari: https://sanjo.eu.auth0.com/authorize?state=5fpqgpuQmX1r6qNG-oSYVUoycmjxotroBw9FP_IYyOw&response_type=code&redirect_uri=auth0.samples.Auth0Sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback&client_id=ZQxpWut8dTXdHCNvBm9OvOZ32kEPLCW0&audience=https://sanjo.eu.auth0.com/userinfo&code_challenge=DZ-jTmoPqWH38O3mI6WpnkUeLiiojFTd3x05HgjibYw&code_challenge_method=S256&scope=openid%20profile&auth0Client=eyJuYW1lIjoiQXV0aDAuc3dpZnQiLCJ2ZXJzaW9uIjoiMS44LjAiLCJzd2lmdC12ZXJzaW9uIjoiMy4wIn0
2018-01-09 20:04:22.198381+0200 Auth0Sample[4957:396599] [App] if we're in the real pre-commit handler we can't actually add any new fences due to CA restriction
2018-01-09 20:04:22.198733+0200 Auth0Sample[4957:396599] [App] if we're in the real pre-commit handler we can't actually add any new fences due to CA restriction
2018-01-09 20:04:28.102352+0200 Auth0Sample[4957:396599] [App] if we're in the real pre-commit handler we can't actually add any new fences due to CA restriction
iOS Safari: auth0.samples.auth0sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback?error=unauthorized&error_description=Access%20denied.&state=5fpqgpuQmX1r6qNG-oSYVUoycmjxotroBw9FP_IYyOw
Error: Access denied.

[cocojoe]

Thanks, so a simple way to sanity check is to copy the authorize url into a browser. Doing this I get:

Callback URL mismatch.
The url "auth0.samples.Auth0Sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback" is not in the list of allowed callback URLs: auth0.samples.auth0sample://sanjo.eu.auth0.com/ios/auth0.samples.auth0sample/callback.

The callback URL is case sensitive so you need to update the Callback to use auth0.samples.Auth0Sample://sanjo.eu.auth0.com/ios/auth0.samples.Auth0Sample/callback in the Auth0 Dashboard and it should work.

[SanjoDeundiak]

@cocojoe I changed it while digging around to find the issue. Now I've reverted allowed callbacks and get the same "Access denied" error

[cocojoe]

@SanjoDeundiak I am wondering if there is something else going on that has not been mentioned, have you been trying out Rules in the dashboard?

If you have please disable them and re-test.

[SanjoDeundiak]

@cocojoe yes, that was the case. It turned out that creating default whitelist rule will block nearly all emails from sign up/sign in. Thank you for your help)
P.S. Adding some warning to this page for people like me, who digs everywhere to check out what service can do, would be great.