Error getting scim configuration from jans-config-api when test-client is used

[devrimyatar]

Describe the bug
jans-config-api raises insufficient scope when test-client is used. In swagger file, scope for getting scim configuration is https://jans.io/scim/config.readonly, but config-api raises

'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]

To Reproduce
Steps to reproduce the behavior:

1. Install linux-jans with setup option --cli-test-client
2. Execute CLI as /opt/jans/jans-cli/config-cli.py -use-test-client
3. Go option 12 (SCIM), then 1 (Config Management), finally 1 (Retrieves SCIM App configuration)
4. See this error:

2022-06-27 15:57:12,576 DEBUG https://snap.gluu.org:443 "GET /jans-config-api/scim/config HTTP/1.1" 401 172
2022-06-27 15:57:12,576 DEBUG https://snap.gluu.org:443 "GET /jans-config-api/scim/config HTTP/1.1" 401 172
2022-06-27 15:57:12,576 DEBUG response body: b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'
2022-06-27 15:57:12,576 DEBUG response body: b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'
Error retreiving data

Unauthorized
b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'

Expected behavior
jans-config-api should return scim configuration

Additional context
Whole debug output:

Retrieves SCIM App configuration
Retrieves SCIM configuration.
-----------------------------
Please wait while retreiving data ...

Getting access token for scope https://jans.io/scim/config.readonly
2022-06-27 15:57:12,418 DEBUG Starting new HTTPS connection (1): snap.gluu.org:443
2022-06-27 15:57:12,418 DEBUG Starting new HTTPS connection (1): snap.gluu.org:443
send: b'POST /jans-auth/restv1/token HTTP/1.1\r\nHost: snap.gluu.org\r\nAccept-Encoding: identity\r\nContent-Length: 82\r\nContent-Type: application/x-www-form-urlencoded\r\nauthorization: Basic MTgwMC5kZjdmYWEyZi03ZWU4LTQxZWUtOWZmOC1kMTI1ZDg3ODA4MGU6ZXdkYkFRdW9SRUdV\r\n\r\n'
send: b'grant_type=client_credentials&scope=https%3A%2F%2Fjans.io%2Fscim%2Fconfig.readonly'
reply: 'HTTP/1.1 200 OK\r\n'
header: Date: Mon, 27 Jun 2022 09:27:12 GMT
header: Server: Apache/2.4.41 (Ubuntu)
header: X-Xss-Protection: 1; mode=block
header: X-Content-Type-Options: nosniff
header: Strict-Transport-Security: max-age=31536000; includeSubDomains
header: Expires: Thu, 01 Jan 1970 00:00:00 GMT
header: Cache-Control: no-store
header: Content-Type: application/json
header: Pragma: no-cache
header: Content-Length: 141
header: Set-Cookie: X-Correlation-Id=50b76976-6f82-41a9-8c2c-93b526abbf9b; Secure; HttpOnly;HttpOnly
2022-06-27 15:57:12,499 DEBUG https://snap.gluu.org:443 "POST /jans-auth/restv1/token HTTP/1.1" 200 141
2022-06-27 15:57:12,499 DEBUG https://snap.gluu.org:443 "POST /jans-auth/restv1/token HTTP/1.1" 200 141
2022-06-27 15:57:12,513 DEBUG Starting new HTTPS connection (1): snap.gluu.org:443
2022-06-27 15:57:12,513 DEBUG Starting new HTTPS connection (1): snap.gluu.org:443
send: b'GET /jans-config-api/scim/config HTTP/1.1\r\nHost: snap.gluu.org\r\nAccept-Encoding: identity\r\nAccept: application/json\r\nUser-Agent: Swagger-Codegen/1.0.0/python\r\nAuthorization: Bearer deef136d-56db-4f69-aecd-510016e1c9d6\r\nContent-Type: application/json\r\n\r\n'
reply: 'HTTP/1.1 401 Unauthorized\r\n'
header: Date: Mon, 27 Jun 2022 09:27:12 GMT
header: Server: Apache/2.4.41 (Ubuntu)
header: X-Xss-Protection: 1; mode=block
header: X-Content-Type-Options: nosniff
header: Strict-Transport-Security: max-age=31536000; includeSubDomains
header: Content-Type: application/json
header: WWW-Authenticate: Bearer
header: Content-Length: 172
2022-06-27 15:57:12,576 DEBUG https://snap.gluu.org:443 "GET /jans-config-api/scim/config HTTP/1.1" 401 172
2022-06-27 15:57:12,576 DEBUG https://snap.gluu.org:443 "GET /jans-config-api/scim/config HTTP/1.1" 401 172
2022-06-27 15:57:12,576 DEBUG response body: b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'
2022-06-27 15:57:12,576 DEBUG response body: b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'
Error retreiving data

Unauthorized
b'oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]'

[pujavs]

@devrimyatar, Issue is with the test client code.
When tested with client with required scope the functionality is working

[devrimyatar]

@pujavs Error is clear
oAuth authorization error Insufficient scopes! , Required scope: [https://jans.io/oauth/config/fido2.readonly], however token scopes: [https://jans.io/scim/config.readonly]

When I change this line https://github.com/JanssenProject/jans/blob/main/jans-config-api/docs/jans-config-api-swagger.yaml#L2659

From
- oauth2: [https://jans.io/scim/config.readonly]
To
- oauth2: [https://jans.io/oauth/config/fido2.readonly]

It works. We need this adjustment. It is not clear to me why retreiving scim configuration requires a fido2 scope.

[pujavs]

@devrimyatar i have fixed the conflict of path between SCIM and Fido via #1805
However you will have to check the test-client scopes

With test client it is giving error Insufficient scopes for few endpoints that i tested,

SCIM

Attributes

UMA Resource

[pujavs]

Assigning it to @devrimyatar for verifying issue with test-client

[devrimyatar]

This issue was fixed before