Login on test01-database fails

[christoph-maurer]

The verification of test01-database failed. This led to the problem that I could not successful login on test01-database. It was solved by correcting the values of "RedirectUris" and "PostLogoutRedirectUris".

Starting point:

With

mutation {
  verifyDatabase(input: { databaseId: "21ea41a4-c989-4862-a34d-1bce0a38d428" }) {
    errors {
      code
      message
      path
    }
  }
}

on https://www.building-integrated-solar-systems.com/graphql/ , I get

{
  "data": {
    "verifyDatabase": {
      "errors": [
        {
          "code": "REQUEST_FAILED",
          "message": "Failed with status code  to request https://www.solar-in-the-facade.com/graphql.",
          "path": [
            "input"
          ]
        }
      ]
    }
  }
}

Although the verification code on https://www.solar-in-the-facade.com/graphql/ seems right:

{
  "data": {
    "verificationCode": "FzopZGYWAMyj21pp1lBZHQMSSXbid8sQB9EDejzgu+MmgooWcbwebqs8lCJuLU/pCXHI8IT9JfHMhv7nUIfegA=="
  }
}

[christoph-maurer]

The logs show

backend-1        | [13:08:46 INF] The request URI matched a server endpoint: Token.
backend-1        | [13:08:46 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
reverse_proxy-1  | 172.20.0.1 - - [28/Apr/2026:13:08:46 +0000] "POST /connect/token HTTP/1.1" 400 187 "-" "Metabase/1.0.0.0 OpenIddict.Client.SystemNetHttp/7.4.0.0" "172.26.4.1"
backend-1        | [13:08:46 INF] The token request was rejected because the application 'metabase' was not allowed to use the resource https://www.building-integrated-solar-systems.com/graphql/.
backend-1        | [13:08:46 INF] The response was successfully returned as a JSON document: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.
backend-1        | [13:08:46 INF] HTTP POST /connect/token responded 400 in 247.5234 ms
backend-1        | [13:08:46 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [13:08:46 INF] The token response returned by https://www.building-integrated-solar-systems.com/connect/token was successfully extracted: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.
backend-1        | [13:08:46 INF] The token request was rejected by the remote authorization server: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.
backend-1        | [13:08:46 WRN] Failed to create access token for database 21ea41a4-c989-4862-a34d-1bce0a38d428.
backend-1        | OpenIddict.Abstractions.OpenIddictExceptions+ProtocolException: An error occurred while authenticating the client application.
backend-1        |   Error: invalid_request
backend-1        |   Error description: The token request was rejected by the remote server.
backend-1        |   Error URI: https://documentation.openiddict.com/errors/ID2147
backend-1        |    at OpenIddict.Client.OpenIddictClientService.AuthenticateWithClientCredentialsAsync(ClientCredentialsAuthenticationRequest request)
backend-1        |    at OpenIddict.Client.OpenIddictClientService.AuthenticateWithClientCredentialsAsync(ClientCredentialsAuthenticationRequest request)
backend-1        |    at Metabase.Services.QueryingDatabases.CreateRestrictedAccessTokenForDatabaseAsync(Database database, CancellationToken cancellationToken) in /app/src/Services/QueryingDatabases.cs:line 84
reverse_proxy-1  | 172.20.0.1 - - [28/Apr/2026:13:08:50 +0000] "POST /graphql HTTP/1.1" 200 187 "https://www.building-integrated-solar-systems.com/graphql/assets/graphql-engine-scheduler.b80d8424.BIAP1cE9.js" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" "47.64.113.101"
backend-1        | [13:08:50 INF] HTTP POST /graphql responded 200 in 12557.1388 ms

[christoph-maurer]

backend-1        | [13:32:48 INF] The request URI matched a server endpoint: Token.
backend-1        | [13:32:48 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [13:32:49 INF] Client authentication failed for metabase.
**backend-1        | [13:32:49 INF] The authentication demand was rejected because the confidential application 'metabase' didn't specify valid client credentials.**
backend-1        | [13:32:49 INF] The response was successfully returned as a JSON document: {
backend-1        |   "error": "invalid_client",
backend-1        |   "error_description": "The specified client credentials are invalid.",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2055"
backend-1        | }.
backend-1        | [13:32:49 INF] HTTP POST /connect/token responded 401 in 176.1723 ms
backend-1        | [13:32:49 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [13:32:49 INF] The token response returned by https://www.building-integrated-solar-systems.com/connect/token was successfully extracted: {
backend-1        |   "error": "invalid_client",
backend-1        |   "error_description": "The specified client credentials are invalid.",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2055"
backend-1        | }.
backend-1        | [13:32:49 INF] The token request was rejected by the remote authorization server: {
backend-1        |   "error": "invalid_client",
backend-1        |   "error_description": "The specified client credentials are invalid.",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2055"
backend-1        | }.
backend-1        | [13:32:49 WRN] Failed to create access token for database 21ea41a4-c989-4862-a34d-1bce0a38d428.
backend-1        | OpenIddict.Abstractions.OpenIddictExceptions+ProtocolException: An error occurred while authenticating the client application.
backend-1        |   Error: invalid_client
backend-1        |   Error description: The token request was rejected by the remote server.
backend-1        |   Error URI: https://documentation.openiddict.com/errors/ID2147
backend-1        |    at OpenIddict.Client.OpenIddictClientService.AuthenticateWithClientCredentialsAsync(ClientCredentialsAuthenticationRequest request)
backend-1        |    at OpenIddict.Client.OpenIddictClientService.AuthenticateWithClientCredentialsAsync(ClientCredentialsAuthenticationRequest request)
backend-1        |    at Metabase.Services.QueryingDatabases.CreateRestrictedAccessTokenForDatabaseAsync(Database database, CancellationToken cancellationToken) in /app/src/Services/QueryingDatabases.cs:line 84
reverse_proxy-1  | 172.20.0.1 - - [28/Apr/2026:13:32:53 +0000] "POST /graphql HTTP/1.1" 200 187 "https://www.building-integrated-solar-systems.com/graphql/assets/graphql-engine-scheduler.b80d8424.BIAP1cE9.js" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" "47.64.48.152"
backend-1        | [13:32:53 INF] HTTP POST /graphql responded 200 in 13096.1403 ms

[christoph-maurer]

I have reset the client secret of test01-metabase. When try to verify the test01-database, I get now the response

{
  "errors": [
    {
      "message": "Failed to authenticate the claims principal in the HTTP context."
    }
  ]
}

[christoph-maurer]

I have reset the client secret of test01-database, too.

backend-1        | [14:23:44 INF] The request URI matched a server endpoint: Token.
backend-1        | [14:23:44 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [14:23:44 INF] The token request was rejected because the application 'metabase' was not allowed to use the resource https://www.building-integrated-solar-systems.com/graphql/.
backend-1        | [14:23:44 INF] The response was successfully returned as a JSON document: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.
backend-1        | [14:23:44 INF] HTTP POST /connect/token responded 400 in 94.2539 ms
backend-1        | [14:23:44 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [14:23:44 INF] The token response returned by https://www.building-integrated-solar-systems.com/connect/token was successfully extracted: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.

[christoph-maurer]

When I try to log in on https://www.solar-in-the-facade.com/ , I see that https isn't working and I get the Status Code: 400; Bad Request and the logs

backend-1        | [15:02:41 INF] The pushed authorization request was successfully sent to https://www.building-integrated-solar-systems.com/connect/par: {
backend-1        |   "client_id": "test01-database",
backend-1        |   "redirect_uri": "https://www.solar-in-the-facade.com/connect/callback/login/metabase",
backend-1        |   "response_type": "code",
backend-1        |   "response_mode": "query",
backend-1        |   "scope": "openid offline_access profile api:read api:write api:database:manage",
backend-1        |   "nonce": "kDHXvVP3_QNM8lpWGHKlVhGecHlDcSUMR2C9PJbrUO4",
backend-1        |   "code_challenge": "-37xmUjeuK47TFNBO-ZmL1Dv7Gla2MzwtU2L0sp3rbs",
backend-1        |   "code_challenge_method": "S256",
backend-1        |   "state": "bJVcvK8DvILfePr9PxtlI-czM6HKR2i98D6jQp3b4aE",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [15:02:41 INF] The pushed authorization response returned by https://www.building-integrated-solar-systems.com/connect/par was successfully extracted: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "The specified 'redirect_uri' is not valid for this client application.",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2043"
backend-1        | }.
backend-1        | [15:02:41 INF] The pushed authorization request was rejected by the remote authorization server: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "The specified 'redirect_uri' is not valid for this client application.",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2043"
backend-1        | }.
backend-1        | [15:02:41 INF] AuthenticationScheme: OpenIddict.Client.AspNetCore was challenged.
backend-1        | [15:02:41 INF] HTTP GET /connect/login responded 400 in 5559.4157 ms

[christoph-maurer]

The values of "RedirectUris" and "PostLogoutRedirectUris" were switched. After fixing that, I can login on test01-database https://www.solar-in-the-facade.com/ .