"unauthorized_scope_error" for LinkedIn - Current LinkedIn OAuth method is deprecated: migrate to OIDC

[jack-michaud]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

When attempting to log in with LinkedIn on a new Supabase project, I get this error:

Here is the URL of the error page:

https://api.linkedin.com/oauth/v2/authorization?client_id=78l5s566gf425m&redirect_to=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F%3Ferror%3Dunauthorized_scope_error%26error_description%3DScope%2B%2526quot%253Br_emailaddress%2526quot%253B%2Bis%2Bnot%2Bauthorized%2Bfor%2Byour%2Bapplication%2F&redirect_uri=https%3A%2F%2Fdbtdfqgdpjdmqjuozvfn.supabase.co%2Fauth%2Fv1%2Fcallback&response_type=code&scope=r_emailaddress+r_liteprofile&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTE3NjAxNTIsInNpdGVfdXJsIjoiaHR0cHM6Ly9taW5kZnVsZGF0YWFpLmNvbS9hcHAiLCJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImZ1bmN0aW9uX2hvb2tzIjpudWxsLCJwcm92aWRlciI6ImxpbmtlZGluIiwicmVmZXJyZXIiOiJodHRwczovL21pbmRmdWxkYXRhYWkuY29tL2FwcCIsImZsb3dfc3RhdGVfaWQiOiIifQ.HzKX4BvpLoNIycBomDeJPDohliL2ANnDZkR40hO2dHo

There does seem to be an error embedded in the URL: 'unauthorized_scope_error: scope "r_emailaddress" is not authorized for your application.'

After some digging, I found that r_emailaddress is the scope you get through the now deprecated "Sign In with LinkedIn" product. From https://www.linkedin.com/pulse/how-get-signin-linkedin-work-taric-andrade/,

However, as Sign In with LinkedIn has been deprecated since Aug 1 2023, (deprecation notice), this option is no longer available to new app developers.

My app has the following products enabled with the following scopes:

To Reproduce

1. Follow the steps for LinkedIn Auth from Log In with LinkedIn with a new LinkedIn app
2. Request the scopes for "Sign In With LinkedIn using OpenID Connect"
3. Attempt to log in with LinkedIn
4. See error

Expected behavior

We should be able to log in with the scopes available to app developers.

Screenshots

See Additional Context.

System information

• OS: [e.g. macOS, Windows]
• Browser (if applies) [e.g. chrome, safari]
• Version of supabase-js: [e.g. 6.0.2]
• Version of Node.js: [e.g. 10.10.0]

Additional context

The code to login was pulled from the Log In with LinkedIn docs:

  const { data, error } = await supabaseClient.auth.signInWithOAuth({
    provider,
  });

Supabase seems to automatically attempt to request these scopes even though they are now impossible to get. https://github.com/supabase/gotrue/blob/4ff1fe058cfab418c445808004091e89dcf87124/internal/api/provider/linkedin.go#L78

[juliabower]

I'm having the same issue

[hf]

Generally switching to OIDC shouldn't be too hard. Some community help would be appreciated as the team won't be able to pick this up too quickly.

[Cpt0Teemo]

We have run into the same issue, r_emailaddress has been changed to email for us. Needs to be checked out more though.

[ShueiYang]

I also run to the issue, when creating a new app in Linkedln, the Oauth no longer work, get error like Uncaught ReferenceError: require is not defined and the api.linkdln.com/li/track 404 not found.

[Cpt0Teemo]

I've tried seeing what happens if we modify just the scopes added by gotrue to see if it was just a quick fix to change the scopes "r_emailaddress" and "r_liteprofile" to openid, profile and email. This sends us to the correct linkedin login page with the successful consent page before successfully redirecting us to the correct supabase callback. The callback is called with the query parameters "code" and "state".
Sadly supabase then redirects to our website with the following error:
/?error=server_error&error_description=Error+getting+user+email+from+external+provider
I am unsure on whether supabase was expecting an email in the JWT giving in "state", which does not have one (unsure if it did give one before), or if there is another call or should now have another call done by supabase trying to retrieve the email from linkedIn after the login using the token returned.

[jack-michaud]

Generally switching to OIDC shouldn't be too hard. Some community help would be appreciated as the team won't be able to pick this up too quickly.

@hf Is the Apple provider a good starting point to draw inspiration from? Are there any pitfalls to be aware of here?

[alexcraig043]

I've tried seeing what happens if we modify just the scopes added by gotrue to see if it was just a quick fix to change the scopes "r_emailaddress" and "r_liteprofile" to openid, profile and email. This sends us to the correct linkedin login page with the successful consent page before successfully redirecting us to the correct supabase callback. The callback is called with the query parameters "code" and "state". Sadly supabase then redirects to our website with the following error: /?error=server_error&error_description=Error+getting+user+email+from+external+provider I am unsure on whether supabase was expecting an email in the JWT giving in "state", which does not have one (unsure if it did give one before), or if there is another call or should now have another call done by supabase trying to retrieve the email from linkedIn after the login using the token returned.

I have the exact same experience currently.

Seems like the oauthScopes on lines 78-79 should be changed?

https://github.com/supabase/gotrue/blob/master/internal/api/provider/linkedin.go#L16

[mansueli]

Can you test it with the scopes in the LinkedIn docs after changing it, @alexcraig043?
I think this might be what's required to fix the issue.

https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2?context=linkedin%2Fconsumer%2Fcontext#validating-id-tokens

{
    "issuer": "https://www.linkedin.com",
    "authorization_endpoint": "https://www.linkedin.com/oauth/v2/authorization",
    "token_endpoint": "https://www.linkedin.com/oauth/v2/accessToken",
    "userinfo_endpoint": "https://api.linkedin.com/v2/userinfo",
    "jwks_uri": "https://www.linkedin.com/oauth/openid/jwks",
    "response_types_supported": [
        "code"
    ],
    "subject_types_supported": [
        "pairwise"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "iat",
        "exp",
        "sub",
        "name",
        "given_name",
        "family_name",
        "picture",
        "email",
        "email_verified",
        "locale"
    ]
}

[tobias-istvan]

Hello,

While I'm not well-versed in Go development, I've made an attempt to address the issue. I kindly request a Go developer to review my proposed solution located at: https://github.com/tobias-istvan/gotrue/tree/fix/linkedin-auth.

I tested the solution locally and successfully managed to log in using GoTrueJs. I was able to obtain an access code; however, I encountered a challenge when attempting to proceed with further testing. Could someone with expertise in this area please assess and validate the provided solution?

Changed file: https://github.com/tobias-istvan/gotrue/blob/fix/linkedin-auth/internal/api/provider/linkedin.go

Thank you.

[AMUZY]

Can you test it with the scopes in the LinkedIn docs after changing it, @alexcraig043? I think this might be what's required to fix the issue.

https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2?context=linkedin%2Fconsumer%2Fcontext#validating-id-tokens

{
    "issuer": "https://www.linkedin.com",
    "authorization_endpoint": "https://www.linkedin.com/oauth/v2/authorization",
    "token_endpoint": "https://www.linkedin.com/oauth/v2/accessToken",
    "userinfo_endpoint": "https://api.linkedin.com/v2/userinfo",
    "jwks_uri": "https://www.linkedin.com/oauth/openid/jwks",
    "response_types_supported": [
        "code"
    ],
    "subject_types_supported": [
        "pairwise"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "iat",
        "exp",
        "sub",
        "name",
        "given_name",
        "family_name",
        "picture",
        "email",
        "email_verified",
        "locale"
    ]
}

Bro I've been struggling to set this up in Next Auth. I'm trying to authenticate users with LinkedIn. I just can't figure it out. Any help please? I get the message: 'jwks_uri must be configured on the issuer'

[kangmingtay]

Hey everyone, the current linkedin oauth provider in gotrue will only work for linkedin oauth apps created before this API change - we haven't started on the new implementation for OIDC yet due to the lack of bandwidth. As @hf mentioned (#1216 (comment)), some community help here would be appreciated!

I see that @tobias-istvan has kindly contributed a PR for this but it can't modify the existing linkedin oauth provider since it's a breaking change as existing oauth apps rely on it. A new linkedin provider needs to be created - you can consider naming it linkedin-oidc or linkedin-v2.

[alexcraig043]

@kangmingtay would the fix be as simple as making a separate linkedin-oidc file that has @tobias-istvan's updated code?

[kangmingtay]

@alexcraig043 unfortunately, no. There are some other places where changes need to be made like adding a case for the new provider here. Ideally, you would also want to be able to run gotrue locally and test out the new provider implementation to be sure that it works before making the PR.

[thomastilkema]

I decided to skip using Supabase for logging in with LinkedIn. There's a very clear page on how to login with LinkedIn on one of their documentation pages. It helped me a lot so far: Authorization Code Flow (3-legged OAuth)

[ajstokar]

Having the same problem as well and so is Auth0. Who is going to fix it first?

[elmaester]

Need a fix please 🙏🏻

[kangmingtay]

hey everyone, @josmo has kindly contributed a fix for this and we're just reviewed and merged the changes! we're looking at a rough timeline of 1-2 weeks before this is rolled out to all projects on the platform. There are bunch of backward compatibility checks we need to iron out before this goes out to prevent existing apps using the old linkedin API from breaking.

thanks so much for everyone's patience!

[samducker]

Hi @kangmingtay any eta on this being rolled out now it's been 2 weeks?

[meera]

Any ETA on on this issue?

[kangmingtay]

hey @samducker and @meera and everyone else here, we've released the linkedin oidc provider to prod already - please check out the updated docs here

with supabase-js v2.38.2, you should be able to do the following to use the new linkedin provider

const { data, error } = await supabase.auth.signInWithOAuth({
  provider: 'linkedin_oidc'
})

[prnews-io-tech]

@kangmingtay Hello! I'm using supabase-js v 2.38.4 via @nuxtjs/supabase and keep getting this error on redirect:

Unsupported provider: Provider linkedin_oidc could not be found

My URL looks like: /auth/v1/authorize?provider=linkedin_oidc

[ahmedabdelkafi1]

I encountered the following error: {'code': 400, 'msg': 'Unsupported provider: Provider linkedin_oidc could not be found'}. Is there a solution available?