Error connecting to AAA STS for RDP access - username correct but suspecting URL migration from TR to Refinitiv is the cause
Hi
We are integrating with AAA retrieving the STS token for access to RDP streaming pricing. Until recently we have been successfully authenticating from the existing Thomson Reuters URL https://sts.login.cp.thomsonreuters.net/
Two weeks ago we tried to connect a new users on production with AAA. However when they use the above URL they get an error
2021-08-05 13:12:17.970 DEBUG SerializableWebMessageBase: {"BaseUri":https://sts.login.cp.thomsonreuters.net/,"ClientId":"*******","ClientSecret":"*****","RequestID":"1","HttpStatus":200,"UseJsonSerialization":true} Subject: SerializableAAAClient
2021-08-05 13:12:20.681 DEBUG {"error": "access_denied", "error_description": "Invalid username or password."}
We have tested the same credentials on:
- User's Eikon login = successful
- RDP playground = successful
We think this maybe due to the migration in domains. Is that correct? Could there be another cause for the failure to login and receive the STS token?
If the issue is the Domain, could someone confirm the correct URL is identity.ciam.refinitiv.net and when was this change expected to be made?
Thank you,
Nick
Hi @Nick.Straatsma ,
The OAuth token URL has been: https://api.refinitiv.com:443/auth/oauth2/v1/token for a long time now. Can you try this endpoint.
Hi @Gurpreet
Thanks very much for the answer. This helped and we also discovered that some of the problem was our TLS version and using JSON instead of URL encoded message body. Here is summary and open questions.
Doing this fixed/enabled us to connect:
- https://sts.login.cp.thomsonreuters.net/
- Resource Owner Password Credential = Successful
- PKCE = successful
- https://sts.identity.ciam.refinitiv.net
- Resource Owner Password Credential = Successful
- PKCE = failing
- https://api.refinitiv.com:443/auth/oauth2/v1/token
- Resource Owner Password Credential = Successful
- PKCE = failing
Questions
- Is there documentation for the URL migrations and supported connection types?
- Do you expect PKCE to work on the new URLs? Attached is a code snippet. We don't get especially verbose responses on failure.
I would recommend that you directly get in touch with STS gateway team to get details for which endpoints will support PKCE.