403 Forbidden error when creating new users through API

d1nch8g · January 13, 2025, 9:19am

I have…

Read the following guideline: https://docs.squidex.io/01-getting-started/installation/troubleshooting-and-support. I understand that my support request might get deleted if I do not follow the guideline.
Used code blocks with ``` to format my code examples like JSON or logs properly.

I’m submitting a…

Regression (a behavior that stopped working in a new release)
Bug report
Performance issue
Documentation issue or request

Current behavior

Create user POST request in UserManagement section is always returning 403 Forbidden error, when using admin access token received from clients section in settings (also when i use bearer token taken from chrome developer tools Authorization header, the same request works normally).

Expected behavior

Create user POST request is returning 201 Created.

Minimal reproduction of the problem

Setup squidex with docker
Create new app
Go to settings, clients and get client id and client secret, set role to Admin
Obtain access token from /identity-server/connect/token endpoint
Use that access token to execute CreateUser request

Environment

App Name: default

Self hosted with docker
Self hosted with IIS
Self hosted with other version
Cloud version

Version: 7.15.0.0

Sebastian · January 13, 2025, 10:02am

The client section is only app specific, the user management needs more permissions. There are two options for that:

If you are an admin yourself, you can go to the profile page and create a client identifer for your own user.
You can create a client ID using settings or env variables: squidex/backend/src/Squidex/appsettings.json at master · Squidex/squidex · GitHub

d1nch8g · January 13, 2025, 10:44am

Thank you very much! By the way, is there any option to obtain access token for newly created user via API? Or is it somehow possible to get API token using user login and password?

Sebastian · January 13, 2025, 10:49am

No, this is not possible. Why do you need that?

d1nch8g · January 13, 2025, 10:57am

I am using squidex as a backend server for my content, and I need to see the history of edits for schemas and content with accordance to specific user. Also i will create users automatically, since their accounts already exist in different service. Would it be possible to receive client_id and client_secret for new users through API?

Sebastian · January 13, 2025, 11:12am

This does not answer my question why you need specific client IDs for users.

d1nch8g · January 13, 2025, 11:25am

I have my own user database, which is stored outside of squidex. And i have my own backend which is using squidex as database. I need users from that database to be able to login to my service and execute operations, like watching and creating schemas and contents. To see the proper history of edits on specific content or schema, operations should be executed by different clients, and i am trying to find a way to create these clients, say one new client for each new user.