OAUTH2 auth is successful but token endpoint is returned instead of api endpoint

[wmlele]

Hello,

trying to access an OAUTH2/OIDC protected endpoint, but the Response contains the output on the OAUTH Token request, instead of the protected API endpoint (which is never called despite a successful oauth):

The {{oidc_issuer}}/me (userinfo) endpoint is never called, the output is from the successfull call to /token

This is what insomnia returns for the exact same configuration

Not sure if it's a mistake on my side or something different from my expectations.

Thanks

[guilhermeferrari]

+1

[diogenesc]

Facing the same issue here

[wmlele]

Just a follow up on this. Of course you can use bruno for an oauth/oidc protected api endpoint.
Just define an empty request with oauth2 authentication, and store the access_token as a variable, then just do a bearer token auth on the actual APIs using the stored access_token.
Not sure though this is the way it was intended?

[diogenesc]

Just a follow up on this. Of course you can use bruno for an oauth/oidc protected api endpoint. Just define an empty request with oauth2 authentication, and store the access_token as a variable, then just do a bearer token auth on the actual APIs using the stored access_token. Not sure though this is the way it was intended?

Probably not, seems wrong if we think how others API clients works.

[ryanholden8]

Any update on this? Seems this is a confirmed bug based on all the referencing from #2148?

[diogenesc]

+1

[WiredNerd]

+1
This is one of the issues preventing my team from adopting Bruno

[nmartinon]

+1 My team also just can't use bruno because of this

[fekitibi]

+1

[deinspanjer]

I'm really excited with the potential of Bruno here but I'm running into the same issue.
If I try to set up Oauth2 as the auth directly in a request, the actual request doesn't go through, only the token issuing request.

If I try to set up Oauth2 at the collection level, and set a request to inherit, I see the note:
Note: You need to use scripting to set the access token in the request headers.

But I'm not sure how exactly to do that.
Does the Collection's oauth get automatically called first?
Where is the access token from the collection stored so I can do something with it?

[lord-haffi]

+1
Currently I'm using this workaround (for anybody who didn't find it): #1704 (comment)

[markwimpory]

this seems a bit mad. BIG oneup from me...