unauthorized_client

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

The client is not permitted the grant it asked for (RFC 6749 §4.1.2.1, §5.2).

#Meaning

The client's registration does not include the grant type it used: authorization_code, or implicit for an id_token response type, at /authorize (redirected to the client) or /par; refresh_token, client_credentials or the device code grant at /token; the device code grant at /device_authorization. A public client asking for client_credentials gets it whatever its grant list says, since it has no credential to authenticate with.

#Impact

Every request of that grant from the client fails until the registration changes. It is a misconfiguration, never normal flow. For a user at /authorize the error goes back to the application before any sign-in screen.

#Diagnosis

1. The audit record carries outcome denied, reason unauthorized_client and cause grant_not_allowed or confidential_client_required, under oauth.authorization.requested, oauth.token.issued or oauth.device.requested. Find it by X-Request-ID on the Troubleshooting page.
2. Compare the grant used with the client's grant types (dashboard client page, or spec.grantTypes on its OIDCClient).

#Mitigation

• As a client developer: use a grant the client is registered for, or ask for the registration to be changed. Machine-to-machine access needs a confidential client.
• As an operator: add the grant to the client's registration, or register a separate client for it. A dynamically registered client can only hold authorization_code and refresh_token.
• As a user: tell the application's owner.

#Escalation

If the registration lists the grant and the request is still refused, open an issue with the request id, the server version and the client's registered grant types. Never attach secrets or tokens.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.