Response 403 from custom connector

[adamtj]

Hi!

I have set up a custom connector, nothing fancy or custom code, just plain old custom connector. The API I´m trying to call use OAuth2 for authentication. The auth part seems to work, I can establish a connection without any problems.
However when I try calling the API i get a 403 response and no information about why. So something is obviously not working. 

Here is the part where I get more confused, the call that respond with 403 seems to be an "internal" call to azure, the request looks like this: https://europe-002.azure-apim.net/apim/{myConnectorName:{LongGuid}}{endpoint_for_api_Im_calling}.
As I understands it (guessing), the custom connector itself doesn't make the API call to to endpoint we specified. The connector calls "something on Azure" that makes the actual API call and then returns the respond to the connector. 

So is it Azure returning 403 or is it my Saas API that I'm trying to call that returns 403? Anyone that could enlighten me and point me in a direction how to solve this? Is there a way to se the actual request call somewhere and not the Azure call?

I have multiple custom connectors with OAuth that works just fine and I cant see why this one is any different.

[DennisPreatto]

Hello @adamtj,

I have experienced this issue before and there are many possible things that may cause such an error when performing a request with a custom connector.

Allow me to answer your first question: when you perform a Test operation while developing a custom connector, the PowerPlatform Test environment (which is the one actually performing the request) calls an Azure API endpoint and authenticates that request with the Bearer token that you can see from the Request section of the Test Connector page. In short, the problem is certainly not caused by the mechanism used by PowerPlatform to perform test operations, since the authentication will always succeed between your browser and the Azure endpoint.

So, after we excluded the impossible, whatever remains must be the truth even if it seems impossible.

Since the 403: Unauthorized error occurs when the server is not able authenticate the client, let's start from here. First thing first, could you please upload a screenshot of your OAuth2 configuration of your custom connector?

When you created the connection, are you sure that all fields were correctly populated?

Can you reach your endpoint by using a software like Postman or ReadyAPI? What is the response?

You can also see more details about outbound requests by opening the Developer Tools (CTRL+SHIFT+I or F12) while using the Test functionality in PowerPlatform.

In order to help you solve your issue quickly I will need more information, could you copy your swagger file and paste it here for me to check? Remember to redact host addresses by replacing them with /endpoint/ or something like that.

[adamtj]

Hi @DennisPreatto ,

Thank you for responding!

Alright, that explains the api call to azure in the test section, thanks!

Se my OAuth2 config below:

When initiating the connection everything seems to work just fine, the dialog box for signing in to the Sass service pops up and powerapps returns a successful connection. I'we checked the endpoints and scopes with the support team for the API and the fields should be correctly populated. However, the support mentioned that the response_type should be "code". I can't se a input field for that?

Haven't actually tried to set up postman to reach the API, i will probaly do that to just to make sure my credentialsare valid. However I can't easily change my redirect-url.
I tried DevTools in my browser but I can only se my request to azure, not to my Sass API, or am I missing something?

Heres the swagger/OpenAPI definition for the connector, host and endpoints are redacted.

swagger: '2.0'
info: {title: Advisor API, description: '', version: '1.0'}
host: api.myhost.net
basePath: /
schemes: [https]
consumes: []
produces: []
paths:
  /api/domain/endpoint:
    get:
      responses:
        default:
          description: default
          schema:
            type: array
            items:
              type: object
              properties:
                id: {type: string, description: id}
                concurrencyToken: {type: string, description: concurrencyToken}
                code: {type: string, description: code}
                unit:
                  type: object
                  properties:
                    id: {type: string, description: id}
                    concurrencyToken: {type: string, description: concurrencyToken}
                    name: {type: string, description: name}
                    isActive: {type: boolean, description: isActive}
                    unitType: {type: string, description: unitType}
                  description: unit
                costPerUnit: {type: integer, format: int32, description: costPerUnit}
                pricePerUnit: {type: integer, format: int32, description: pricePerUnit}
                name: {type: string, description: name}
                articleNumber: {type: string, description: articleNumber}
                isActive: {type: boolean, description: isActive}
      summary: GetOutlays
      description: Get outlays
      operationId: GetOutlays
      parameters: []
definitions: {}
parameters: {}
responses: {}
securityDefinitions:
  oauth2_auth:
    type: oauth2
    flow: accessCode
    authorizationUrl: https://server.domain.com/action/authorize
    tokenUrl: https://server.domain.com/action/token
    scopes: {myscopes:according to api docs}
security:
- oauth2_auth: [myscopes:according to api docs]
tags: []

Thanks!

[DennisPreatto]

Hello @adamtj, 

yes it is correct that in the developer tools you would see the request sent to the Azure endpoint, but the response content is actually coming from the Saas API. In this response you should see the same 403 Error.

You should really try with Postman, in order to verify that you can actually get the proper response from the web service. Once we have that test done we can try to better understand why you get an Unauthorized error in response from the web service.

Anyway, when designing your custom connector, in the Definition section, you can use the Import by Sample function and there you can specify custom headers, so if you need the response_code header you can set it there, you can also set URL parameters in that same place.

To create a new request header, in the header section just write the header name followed by a space then followed by the value (you will have to populate the value when submitting the request anyway so it's not really important what you write here), one header for every line.

To create a path parameter, you can use curly brackets like this:

https://myhost.com/API/v1?response_code={$parameter}

Where to put said parameter depends on your web service though. 

I strongly suggest to install Postman and check whether you can obtain the expected response there.

Have a nice day!

[adamtj]

Hi! @DennisPreatto 

Yeah I´ve created at ticket to change my callback Uri to set it up in Postman insted. 

I think the where refering to the Grant Type and the type should be "Code" or correctly Authorization Code, however when inspecting the url parameters during the sign-in step (to get Access Token) param was set to "code" so that should not be the problem.

Like you suggested, I will try to send a request from postman and take it from there.

Thanks for your help!

[kreid]

Did you get anywhere with this? Having similar problem - direct OAuth config in an HTTP step works, custom connector fails with 403.

[adamtj]

Hi @kreid,
I turned out that the Saas provider "forgot" to actually grant med acess to the API, so my connector worked just fine when I was granted acess to the API :).
However when trobleshooting my connector I did get more information in the response when I did the request directly in Postman. So i would higly recommend setting it up in Postman first.