Unable to get an Access token using a named credential and getting a State not Send OAuth Error

Question

I am trying to get SF access token using a named credential as that is the secure way as mention here:

I am basically unable to login successfully and get the following error :

No_Oauth_State&ErrorDescription=State+was+not+sent+back

I have verified that consumer secret and key are entered right in auth provider.

My connected app oauth settings:

My Named Credential:

My authorization provider:

In my Apex:

Http h = new Http();
        HttpRequest req = new HttpRequest();
        req.setEndpoint('callout:Tooling_API_Credential');
        req.setMethod('POST');
        HttpResponse res = h.send(req);

I am able to authenticate the named credential. When I run it I am getting null for access token and in my error logs I see:

16:33:18.0 (26293187)|CALLOUT_REQUEST|[61]|System.HttpRequest[Endpoint=callout:Tooling_API_Credential, Method=POST]
16:33:18.119 (119057588)|NAMED_CREDENTIAL_REQUEST|NamedCallout[Named Credential Id=someID, Named Credential Name=Tooling_API_Credential, Endpoint=https://my-org.sandbox.my.salesforce.com/services/authcallback/SF_Auth_Provider, Method=POST, External Credential Type=EXTERNAL, HTTP Header Authorization=**Method: Bearer - Credential: Not set**, Content-Type=null, Request Size bytes=95, Retry on 401=True]
16:33:18.119 (119872673)|NAMED_CREDENTIAL_RESPONSE|NamedCallout[Named Credential Id=someID, Named Credential Name=Tooling_API_Credential, Status Code=302, Content-Type=null, Response Size bytes=0, Overall Callout Time ms=80, Connect Time ms=47
16:33:18.0 (126697917)|CALLOUT_RESPONSE|[61]|System.HttpResponse[Status=Found, StatusCode=302]
16:33:18.0 (126727368)|HEAP_ALLOCATE|[61]|Bytes:9
16:33:18.0 (126762390)|VARIABLE_SCOPE_BEGIN|[61]|res|System.HttpResponse|true|false
16:33:18.0 (126843252)|VARIABLE_ASSIGNMENT|[61]|res|"System.HttpResponse[Status=Found, StatusCode=302]"|0x422d5269

I then looked at the redirect URL and seeing this:

identity/sso/ui/AuthorizationError?ErrorCode=No_Oauth_State&ErrorDescription=State+was+not+sent+back&Provider

What am I doing wrong?

Just a FYI I am able to click on the test only initialization url and see valid json.

Answer 1

The URL specified in the Named Credential should be the domain URL and not the entire callback URL i.e., it should be just https://my-org.sandbox.my.salesforce.com/.

Usually named credential should consider only the domain URL while posting the HTTP request, but your logs seems to indicate that it's posting to the entire callback URL =https://my-org.sandbox.my.salesforce.com/services/authcallback/SF_Auth_Provider and running into a HTTP 302 error code.

After fixing the URL, edit the Named Credential & ensure that you check the box for Start Authentication Flow on Save, save the named credential and run through the successful authentication.

Also, edit the Authentication Settings for External Systems under your personal settings. Check the box for Start Authentication Flow on Save, save it and run through the successful authentication.