Getting the error : Unable to fetch the OAuth token when using an external credential with "Client Credentials with Client Secret Flow"

Question

I am trying to make a webservice call to an authorization server (OAuth 2.0) using the "client_credentials" grant type, but i receive a "System.CalloutException: Unable to fetch the OAuth token." when executing this code :

    Http httpCls = new Http();
    HttpRequest request = new HttpRequest();
    request.setEndpoint('callout:FasstAPIGEE');
    request.setMethod('POST'); 

When i check the logs , i find these lines, both the name and the Id of the named credential are NULL:

However, when i make the same call via Postaman or curl , it works and i am able to get the access_token

I am sharing with you ma configuration of the named and the external credentials

here is a screenshot of the test i performed in postman

And here the curl command i am using that also works

curl -X POST -u "a1***_x**:xNMq******Gl" -d "grant_type=client_credentials" https://auth.***/oidc/token

Any ideas how to resolve the issue ?

Answer 1

I ran into a similar problem. Turns out that the identity provider url I'm trying to reach for authentication was not setup to follow true OAuth 2.0 standards. It was a custom API and took in the client id and secret as part of a body, not the header, and also required additional unexpected parameters, thus failing when Salesforce tried to call it using its standard processes.

You may need to check to see if this is what's happening to you. It may not be an issue with Salesforce but the identity provider itself. In which case, you will have to go a different route.

Answer 2

HTTP call should not be sent to authorization server, You need to send call to your actual endpoint. Your named credential need to have actual endpoint and external credential need to have your OAuth endpoint. If using client credential flow, Salesforce should auto generate OAuth token(handled automatically) and attach it to your main http call. That’s the benefit of using named credentials/external credentials.