Explanation | Initialization of the OAuth modules has started. |
Action | None, informational only. |
Explanation | Enablement of the OAuth TAI completed successfully. |
Action | None, informational only. |
Explanation | Creation of the OAuth provider completed successfully. |
Action | None, informational only. |
Explanation | OAuth administration commands require a running server environment to modify settings. |
Action | Start the server or deployment manager and try again. |
Explanation | Deletion of the OAuth provider completed successfully. |
Action | None, informational only. |
Explanation | The specified filename must not exist. |
Action | Specify a new file name. |
Explanation | The specified OAuth provider does not exist. |
Action | Check the OAuth provider name and try again. |
Explanation | The command has completed successfully. |
Action | None, informational only. |
Explanation | The specified file name does not exist. |
Action | Check the file name and try again. |
Explanation | The command has completed successfully. |
Action | None, informational only. |
Explanation | The OAuth MBean on this node has been invoked to run a command. |
Action | None, informational only. |
Explanation | The OAuth framework failed to initialize. |
Action | Refer to the exception details for further information. |
Explanation | The OAuth MBean on this node has been invoked to run a command. |
Action | None, informational only. |
Explanation | A configuration error has retrieved registration or lookup of MBeans of type OAuth20ClientMBean. |
Action | Refer to the MBean registration trace logs for further details. |
Explanation | The client provider failed to delete the specified client because of an internal error. |
Action | None, informational only. |
Explanation | The client provider failed to update the specified client because of an internal error. |
Action | None, informational only. |
Explanation | The client provider failed to create a new client because of an internal error. |
Action | None, informational only. |
Explanation | The OAuth20 endpoint servlet cannot find the specified request dispatcher to render the template. |
Action | Double check the configuration parameter and make sure the specified context root and path exist. |
Explanation | The username parameter in the OAuth request was either not specified or was a null string. |
Action | Specify a valid username parameter in the OAuth request. |
Explanation | The client_id parameter specified in the OAuth request does not match the client ID value in the authorization code. These values should match. One reason for this error is that that the client_id parameter in the OAuth request was modified during the OAuth flow. |
Action | Make sure the value of the client_id parameter in the OAuth request is the same client ID value that was used when obtaining the authorization code. |
Explanation | The value of scope parameter in the OAuth request is not valid. The scope parameter must only contain the following hexidecimal characters: [x21, x(23 through 5B), x(5D through 7E)] |
Action | Make sure the scope parameter only contains characters that are supported. |
Explanation | The same parameter was specified multiple times in the OAuth request. |
Action | Double check the parameter in the OAuth request and make sure it is specified only once. |
Explanation | The OAuth service provider could not find the client specified in the value of the client_id parameter in the OAuth request. |
Action | Make sure the client is registered with the OAuth service provider or specify a registered client for the client_id parameter value. Also, ensure that the client is enabled in the OAuth service provider configuration. |
Explanation | The value of client_secret parameter in the OAuth request was not valid. |
Action | Check the value of the client_secret parameter in the OAuth request and make sure it matches the client secret value of the registered client in the OAuth service provider configuration. |
Explanation | The value of the grant_type parameter in the OAuth request is not valid. |
Action | Make sure the value of the grant_type parameter in the OAuth request is from one of the following values: authorization_code, password, client_credentials, refresh_token, implicit, urn:ietf:params:oauth:grant-type:jwt-bearer |
Explanation | The value of the redirect URI parameter in the OAuth request may not be a valid absolute URI. |
Action | Make sure the value of the redirect URI parameter in the OAuth request is a valid absolute URI value. |
Explanation | The value of the response_type parameter in the OAuth request is not valid. |
Action | Check the value of the response_type parameter in the OAuth request and make sure it contains one of the following values: code, token. |
Explanation | The value of the scope parameter in the OAuth request cannot be broader than the scope approved for the client. |
Action | Check the value of the scope parameter in the OAuth request and make sure it is equal to or a subset of the scope that was approved by the resource owner. |
Explanation | The OAuth token was either not in the cache, or the token type or subType did not match the expected value. |
Action | Make sure the client associated with the token is not disabled in the OAuth provider configuration. Also make sure the type and subType of the token both have the values that are expected. |
Explanation | The HTTP method used by the OAuth client is not valid. |
Action | Make sure the client uses the HTTP POST method. |
Explanation | The value of the client_id parameter in the API call did not match the client ID in the authorization code that was sent to the client. |
Action | Check the client_id parameter in the OAuth request or API call and make sure it matches the client ID that was used when obtaining the authorization code. |
Explanation | The value of the redirect_uri parameter in the OAuth request does not match the redirect URI attribute in the registered client. |
Action | Check the value of the redirect_uri parameter in the OAuth request and make sure it matches the redirect URI attribute that exists in the registered client. |
Explanation | The OAuth provider runtime code did not find a required parameter when processing the client request. |
Action | Check the missing parameter in the OAuth request and make sure that it is specified. |
Explanation | An OAuth public client is not allowed to use the client_credentials grant type. |
Action | Check the value of the grant_type parameter in the OAuth request and use a different grant type for the public client. |
Explanation | The OAuth provider is configured to not allow public clients to access the token endpoint. |
Action | If you intend to allow access to public clients, set the allowPublicClients attribute to true in the OAuth provider configuration. |
Explanation | The value of the client_id parameter in the OAuth request does not match the client ID in the refresh token. |
Action | Check the value of the client_id parameter in the OAuth request and make sure it matches the client ID that is contained in the refresh token. |
Explanation | The OAuth provider requires the OAuth request to use HTTPS, but HTTP was used in the request URL. |
Action | Check the request URL in the OAuth request and make sure it uses HTTPS. |
Explanation | The OAuth provider could not verify the client. |
Action | Check that the client ID and client secret are valid and they match the configuration of the OAuth client and OpenID Connect client. |
Explanation | The user does not have the necessary permission to access the resource of OAuth 2.0 and OpenID Connect. |
Action | Contact your security administrator if this is unexpected. Your user must be mapped to one of the roles of the OAuth web application security role map. |
Explanation | OAuth 2.0 and OpenID Connect requests are expected to be directed to a specific subset of endpoints. The request URL might not have been formatted correctly, or the request was directed to a context or endpoint that does not support these requests. |
Action | Check the path of the request to make sure it is properly formatted and directed to a valid endpoint that supports OAuth 2.0 or OpenID Connect requests, whichever is appropriate. |
Explanation | OAuth 2.0 and OpenID Connect requests are expected to be directed to a specific provider based on the filter criteria. However, this request met the criteria for multiple provider filter configurations. |
Action | Check the filter configuration of each provider to make sure the filter criteria do not overlap between multiple providers. |
Explanation | The prompt parameter must not contain other values when a value of 'none' is specified. |
Action | Specify only the 'none' value in the prompt parameter or specify the other values without the 'none' value. |
Explanation | There was an unexpected java.io.IOException while attempting to redirect to the client's redirection URI. |
Action | Review the exception message. |
Explanation | The issuer identifier is missing and it is required to complete the OAuth resource request. This is an internal server error. |
Action | None. |
Explanation | There was an unexpected exception while attempting to write the HTTP response for an OAuth token request. |
Action | Review the exception message. |
Explanation | The issuer identifier is missing and it is required to complete the OAuth token request. This is an internal server error. |
Action | None. |
Explanation | There was an unexpected java.io.UnsupportedEncodingException while attempting to decode an HTTP request query string parameter from the 'application/x-www-form-urlencoded' MIME format for an OAuth token or resource request. |
Action | None. |
Explanation | The OAuth20 provider cannot process the request because the required configuration parameter is not set. |
Action | Check the configuration parameter and make sure the required configuration parameter is configured. |
Explanation | The OAuth20 provider cannot construct the specified class because the specified class does not match the required interface class. |
Action | Check the configuration parameter and make sure the specified class is an implementation class of the required interface class. |
Explanation | The OAuth20 provider cannot instantiate the specified class. |
Action | Review the exception message. |
Explanation | The OAuth20 provider cannot process the request because the specified configuration parameter is invalid. |
Action | Check the configuration parameter and make sure the specified value is valid. |
Explanation | The OAuth20 provider cannot process the request because the grant_type parameter in the request is not allowed to process. |
Action | Check the configuration parameter and make sure the specified value is consistent with the grant_type parameter in the OAuth request. |
Explanation | The OAuth20 provider cannot process the request because the response_type parameter in the request is not allowed to process. |
Action | Check the configuration parameter and make sure the specified value is consistent with the respose_type parameter in the OAuth request. |
Explanation | The same user has too many active sessions with the same OAuth20 provider. |
Action | Either increase the value of the userClientTokenLimit attribute in the configuration to increase the size of the token cache, or use a different user/client combination, such as a different client. |
Explanation | The value of the redirect attribute in the OAuth provider's registered client may not be a valid absolute URI. |
Action | Make sure the value of the redirect attribute in the OAuth provider's registered client configuration is a valid absolute URI value. |
Explanation | The value of the redirect_uri parameter specified in the OAuth or OpenID Connect request does not match any of the redirect URI values specified in the registered client of the OAuth provider. |
Action | Make sure the value of the redirect_uri parameter in the OAuth or OpenID Connect request matches one of the redirect URI values specified in the registered client configuration. |
Explanation | The OAuth or OpenID Connect request should have only one response type. |
Action | Check the value of the response_type parameter in the OAuth or OpenID Connect request and make sure it contains only one response type. |
Explanation | The OAuth token has expired and is no longer valid. |
Action | Request a new OAuth token from the OAuth provider. |
Explanation | The OAuth token is not associated with any client, or the associated client has been disabled in the configuration. |
Action | Check the OAuth provider client configuration to make sure the appropriate client is configured and enabled. |
Explanation | If no redirect URI is included in the request, then a redirect URI must not have been specified in the request for the authorization grant. |
Action | Check the value of the redirect_uri parameter in the OAuth or OpenID Connect request and make sure it matches the redirect URI attribute that exists in the registered client, or do not include a redirect URI in the request for the authorization grant. |
Explanation | The OAuth service provider could not find the client specified in the value of the client_id parameter in the OAuth request. |
Action | Contact your system administrator to resolve the problem. |
Explanation | Either the value of the redirect attribute in the OAuth provider's registered client may not be valid or, if the redirect_uri parameter is specified in the OAuth request, its value does not match the redirect URI value specified in the OAuth provider's registered client. |
Action | Contact your system administrator to resolve the problem. |
Explanation | The value of the client_id parameter in the request did not match the authenticated client_id which is passed in through the request as well. |
Action | Make sure only only one authenticated client_id is in the request. A client_id can be passed through the Authorization header or the parameter of a request. |
Explanation | The requested scope set and the registered scope set must have at least one common scope between them. |
Action | Make sure requested and registered scope sets have at least one common scope between them. |
Explanation | The OpenID Connect request must have a scope with a non empty string. |
Action | Make sure that the OpenID Connect request has a valid scope parameter. |
Explanation | The same user has too many active sessions with the same OAuth20 provider. |
Action | Either increase the value of the userClientTokenLimit attribute in the configuration to increase the size of the token cache, or use a different user/client combination, such as a different client. |
Explanation | The user has either denied the OAuth request by canceling the request on the scope consent form, or some other error has occurred that has denied access to the OAuth request. |
Action | The user must allow the OAuth provider to share the scopes that the client requires in order for the OAuth request to succeed. If the user approved the request, check the logs on the OAuth provider for any additional errors. |
Explanation | The client configuration must contain a list of scopes allowed for the client, otherwise the OpenID Connect authorization requests fail. |
Action | Make sure you register a list of scopes in the client configuration of the OpenID Connect Provider. Set the scope to the allowed scopes or to ALL_SCOPES in the case where all scopes are acceptable. |
Explanation | The OAuth provider could not verify the resource owner. |
Action | Check that the resource owner name and password are valid. |
Explanation | There might have been a problem initializing the client stores for this OAuth provider. |
Action | Check the server logs to ensure that the OAuth provider was initialized correctly. |
Explanation | An OAuth public client is not allowed to use the the specified grant type for this endpoint. Only confidential clients are allowed to use the specified grant type. |
Action | Check the value of the grant_type parameter in the OAuth request and use a different grant type for the public client. |
Explanation | The indicated value of the specific parameter in the OAuth request is not valid. The valid values are listed in the indicated attribute of the server configuration. |
Action | Make sure the values in the request parameter are valid. |
Explanation | The request might be missing information, the server might have encountered an internal error, or some other error may have prevented the server from successfully authenticating the user. |
Action | Contact the system administrator to resolve the problem. |
Explanation | The OAuth provider was not able to verify the application password. |
Action | Confirm that the application password is valid, is not expired, and was not revoked. Also, confirm that the client ID in the access token is the same as the client ID in the Authorization header. |
Explanation | The current configuration might be incorrect. |
Action | Correct the configuration if necessary. |
Explanation | The current configuration might be incorrect. |
Action | Correct the configuration if necessary. |
Explanation | The application password was created with a used_by parameter that indicated an intended client, but it has been submitted to a different client. |
Action | Issue the request again with an application password that is valid for the specified client. |
Explanation | Application passwords or application tokens must be revoked by using the app-passwords or app-tokens endpoints. |
Action | Issue the request again with the URI for the appropriate endpoint to revoke application passwords or application tokens. |
Explanation | The OAuth provider does not support the specified transform algorithm. |
Action | Use one of the transform algorithms shown in the message. |
Explanation | The code_verifier should have a minimum length of 43 characters and a maximum length of 128 characters. |
Action | Send the authorization and token requests again with the updated code_verifier that meets the specified length. |
Explanation | The OAuth provider uses the code_challenge_method specified in the authorization request and transforms the code_verifier unless the code_challenge_method is plain. The transformed value should match with the code_challenge in the authorization request. |
Action | Make sure to send the matching code_challenge and code_verifier and the correct transformation algorithm with the authorization and token requests. |
Explanation | An OAuth client and user combination can request a limited number of access tokens using refresh tokens. A new access token cannot be created. |
Action | Increase the number of access tokens that can be issued through refresh tokens. Alternatively, revoke some of the existing access tokens for the user and OAuth client that is specified in the message. |