Issue: Self Service Password Reset fails to create a Single Sign-On experience using OAuth.
Reason: This issue may occur due to several reasons. The exact solution depends on the Identity Provider used or the SSPR/OAuth configuration.
However, if you find the following error message in the SSPR logs, it may be due to an incorrect HTTP method used in the OAuth userinfo request to the Identity server:
2022-10-10T18:26:58Z, DEBUG, http.PwmResponse, {10083} forcing logout due to error 5071 ERROR_OAUTH_ERROR (unexpected HTTP status code (400) during OAuth userinfo request to https://sso.fed.dev.aws.swacorp.com/idp/userinfo.openid) [10.9.136.83]
2022-10-10T18:26:58Z, ERROR, http.PwmResponse, {10083} 5071 ERROR_OAUTH_ERROR (unexpected HTTP status code (400) during OAuth userinfo request to https://sso.fed.dev.aws.swacorp.com/idp/userinfo.openid) [10.9.136.83]
2022-10-10T18:26:58Z, FATAL, servlet.AbstractPwmServlet, {10083} unexpected error: 5071 ERROR_OAUTH_ERROR (unexpected HTTP status code (400) during OAuth userinfo request to https://sso.fed.dev.aws.swacorp.com/idp/userinfo.openid) [10.9.136.83]
2022-10-10T18:26:58Z, TRACE, client.PwmHttpClient, {10083} received response (id=102) in 158ms: HTTP response status 400 Bad Request [10.9.136.83]
Solution: Ensure to use the correct HTTP method (GET or POST) is used to make the OAuth UserInfo request to the Identity Provider. To select the HTTP method, navigate to Settings > Single Sign On (SSO) Client > OAuth > > OAuth Profile / UserInfo Service Method Type.