Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

consent_required

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The request forbade interaction and the user has not consented to it (OpenID Connect Core 1.0 §3.1.2.6).

Meaning

Sent by /authorize, redirected to the client, when the request carries prompt=none, the user is signed in, and no stored approval covers the client, scopes and resource it asks for. Clients registered by an administrator count as approved; dynamically registered clients and public clients with a non-https redirect URI need the user's approval.

Impact

Normal protocol flow for a silent request: nobody is stuck, but the application has to show the consent screen once with an interactive request. A public client with a loopback redirect is asked every time, so its silent requests always end this way.

Diagnosis

  1. The audit record under oauth.authorization.requested has reason consent_required and cause consent_not_granted.
  2. Compare the requested scopes and resource with what the user approved earlier (oauth.consent.decided records). See Consent.

Mitigation

  • As a client developer: on consent_required, send the user through /authorize without prompt=none. Do not ask for more scopes in silent requests than the user approved.
  • As an operator: register first-party applications through the operator or the AdminService, which counts as administrative consent.
  • As a user: approve the request when the application shows the consent screen.

Escalation

If a request covered by a stored approval is refused, open an issue with the request id, the server version and the scopes requested.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.