UAAC CLI not validating scopes

[x64bytes]

Recently we went through small typo that delayed some of our troubleshooting efforts. Below is the same code we are trying to create a client(The actual scope and authorities are spelled wrong in the code). Surprisingly, uaac never complained, but the authentication for this client keeps failing. After going through many hops, we have identified that the uaac command line is not checking scopes, we saw that its validating grant types, but not --authorities and --scope. Any specific reason that this syntax not validating? or something I am missing to interpret?.

Command With Typo:-

uaac client add testclient --name testclient --scope cloudcontroller.read --authorities cloudcontroller.admin --authorized_grant_types "authorization_code,refresh_token" --access_token_validity 3600 --refresh_token_validity 3600 --secret XXXXXX --redirect_uri https://concourse.domain.com/auth/uaa/callback --autoapprove true

Actual command:-

uaac client add testclient --name testclient --scope cloud_controller.read --authorities cloud_controller.admin --authorized_grant_types "authorization_code,refresh_token" --access_token_validity 3600 --refresh_token_validity 3600 --secret XXXXXX --redirect_uri https://concourse.domain.com/auth/uaa/callback --autoapprove true

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/159348412

The labels on this github issue will be updated when the story is started.

[drnic]

Perhaps give the new uaa cli a go as to where the core team is putting active development.

https://github.com/cloudfoundry-incubator/uaa-cli

[x64bytes]

@drnic I just compiled, but it seems I am getting "You must have a token in your context to perform this command". Any idea on how to log in, if I want to use default admin client account?.

[drnic]

uaa target https://192.168.50.6:8443 --skip-ssl-validation
uaa get-client-credentials-token admin -s <uaa_admin_client_secret>

[x64bytes]

@drnic Thanks.
I have tested this and have still same issues. It's weird, that new uaa is exhibiting the same behavior. the typo is not validated for scopes, but validated for grant types.

[bruce-ricard]

Scopes can be anything. The resource servers can decide to use scopes x64bytes+salmon or hacker.bruce. It's not possible even for the UAA to validate the scopes, even less for the CLI.

Sorry for the 5 year delay btw.