PingIDM

Remote proxy troubleshooting

These troubleshooting topics and a testing checklist address common remote proxy issues:

OAuth 2.0 authentication fails

Symptom: 401 Unauthorized when accessing the proxy.

  • Verify the OAuth 2.0 client exists on the remote instance.

  • Check that clientId and clientSecret match the OAuth 2.0 client credentials on the remote instance.

  • Ensure the OAuth 2.0 client has the client_credentials grant type.

  • Verify tokenEndpointAuthMethod is client_secret_post.

  • Check that the OAuth 2.0 client has the fr:idm:* scope.

Forbidden access

Symptom: 403 Forbidden when querying data.

  • Verify the static user mapping is configured.

  • Check that subject in the static user mapping matches the OAuth 2.0 clientId.

  • Ensure roles include the role configured in the static user mapping (for example, internal/role/platform-provisioning).

Proxy not found

Symptom: 404 Not Found when accessing /openidm/external/idm/<remote-instance-name>.

  • Check that the config was created: GET /openidm/config/external.idm/<remote-instance-name>.

  • Verify the config name matches the proxy name formatting (for example, dot form in config path, slash form in access path).

  • Ensure enabled is true in the configuration.

SSL/TLS certificate errors

Symptom: SSL handshake failures.

  • Import the remote instance’s certificate into the local instance’s truststore.

  • Verify the certificate is valid and not expired.

  • Check network connectivity and firewall rules.

Testing checklist

Before reporting a connectivity issue, verify the following:

  • OAuth 2.0 client is created on the remote instance.

  • OAuth 2.0 client has the client_credentials grant.

  • OAuth 2.0 client has the fr:idm:* scope.

  • tokenEndpointAuthMethod is client_secret_post.

  • Static user mapping is configured on the remote instance.

  • Static user mapping subject matches the OAuth 2.0 client ID.

  • External IDM config is created on the local instance.

  • Config clientId and clientSecret match the OAuth 2.0 client.

  • Config tokenEndpoint points to the correct realm.

  • Config instanceUrl ends with /openidm/.

  • Proxy query succeeds: GET /openidm/external/idm/<remote-instance-name>/managed/user.