3-legged OAuth with Institutional Provider

[Donald Brower]

Hello!

I'm having an issue with OAuth redirects.

I am using the public API with my web app to do a 3-legged OAuth for authentication. Everything works fine if the person signs in to the ORCId site using a password. The session is redirected back to my site and all is good.

However, if the person chooses "Access through your institution", then there is a page to select the instituion, followed by the institution's sign-in page. After doing all this one is then redirected back to the orcid home page. Additionally, it does not appear that I am signed in on the ORCID site. Is this behavior expected? I expected a redirect at the end back to my application.

Thanks,

Don

--

Don Brower, Ph.D.
Digital Projects Lead
Hesburgh Libraries

University of Notre Dame
250B Hesburgh Library

Notre Dame, IN 46556

o: 574-631-1566

e: dbr...@nd.edu

[Pedro Costa]

Hi Don,

I was unable to replicate the behavior you've described. This is the expected behavior for the 3-step OAuth process with an institutional account:

1 - user visits authorization URL

2 - user signs in with institutional account (and links it to an ORCID iD if it isn't yet)

3 - user is redirected to authorization page

4 - user grants permission to client app

5 - user is then sent to the client app's redirect URI appended with an authorization code

Could you please reply with the authorization URL you're using to test and confirm whether or not the steps described above match your testing?

Kind regards,

Pedro Costa

QA Lead

https://orcid.org/0000-0003-4566-1411

[Will J]

Donald, 

I haven't made it to OAuth integration yet but there are a few videos here that may help.  

https://github.com/PNNL-EMSL/orcid_model

[Donald Brower]

Hi Pedro,

Thanks for your reply. I missed it before I went on vacation.

When I used the oauth sign-in again today with the "institutional access" method, everything worked as expected. So my problem appears to be solved.

For reference, the sequence of URLs that I see today are:

1) my app redirects the user to https://orcid.org/oauth/authorize

2) selecting the institutional sign in directs me to https://orcid.org/Shibboleth.sso/Login which then redirects me to my institution's single sign-on page.

3) after the SSO page I am redirected to https://orcid.org/Shibboleth.sso/SAML2/POST

4) and then https://orcid.org/shibboleth/signin

5) and then https://orcid.org/oauth/authorize/third-party-signin-completed

6) and finally back to my app, as expected.

I didn't record a trace of the failed redirects from last week, but it seemed like somewhere around step 4 or 5 there was redirect to https://orcid.org/ and that ended the sequence. The redirects didn't make it back to my application.

Thanks again for your help,

Don

[Pedro Costa]

Hi Don,

Thanks. If you come across any issues again please do let us know.

Pedro Costa

QA Lead

https://orcid.org/0000-0003-4566-1411