OAuth 2.0 Error: Cannot Exchange Auth Code to Token

Problem

All users are unable to log in fall into login deadlock. IDE Services consistently returns the following error message:

"Invalid request. Please try again or contact your administrator. azure-token-exchange-failed: Cannot exchange auth code to token."

Cause

The client secret within the Entra ID auth module in Hub seems to have expired, which disables the ability to exchange the authorization code for a token, leading to the login issue.

Resolution

Note: If no alternative/backup auth modules are available to access Hub whilst the primary auth module has already failed to work, you are no longer able to log in to perform the steps below. Thus, please contact the support team with details and any additional screenshots for further remediation.

To resolve this issue, follow these steps:

1. Manually access the login option page with the /loginOptions endpoint. This allows you to bypass the deadlock and select your alternative/backup auth module (e.g. JetBrains Account auth module) to access Hub and update the expired client secret.

   https://<ide-services-domain-name>.oauth.jetbrains-ide-services.com/loginOptions
   

   Please review: https://support.jetbrains.com/hc/en-us/articles/40072011870354-Auth-Modules-Inquiries-Safe-Practices-for-Configuring-Auth-in-IDE-Services-Cloud-Standalone-License-Vault-Cloud about why JetBrains Account should be used as an alternative auth module.

2. Click the JetBrains Account logo to log in with your JetBrains Account

   

3. Go to Entra ID and navigate to the following path: App registrations -> Your Entra ID application for Hub -> Certificates & Secrets and verify if the client secret has expired. If so, please generate a new client secret.

4. Add the new client secret to Hub. Save the changes.

5. Once the new client secret is updated in Hub, attempt to log in again.

If the issue persists, please reach out to the support team with details and any additional screenshots for further troubleshooting.