Issue in request authorization code using OAuth2 in confluence server

[Kai Gao]

When we try to set up OAuth2 authentication in confluence on-prem server using the below steps, we get invalid_request error when requesting the Authorization code.

To create an incoming link.

1. Login into confluence on-prem server  and Go to   > General Configuration > Application links.
2. Select Create link.
3. Select External application, and then choose Incoming as the direction

4. After this we’ll get client id and client secret of application link.

5. Request Authorization code by redirecting the user to the /rest/oauth2/latest/authorize page with the URL.

https://confluence.integ.us-west-2.beta.kendra.aws.a2z.com/plugins/servlet/oauth2/consent?client_id=7a8aeab250b334901ac54271d09e2fbc&redirect_uri=https://confluence.integ.us-west-2.beta.kendra.aws.a2z.com&response_type=code&scope=READ&code_challenge_method=plain&code_challenge=code_verifier

 6. This is the consent screen that asks the user to approve the application’s request to access their account with the scopes specified in scope. The user is then redirected to the URL specified in redirect_uri. The redirect includes the authorization code

7. Clicking on Allow button results in the below error message and we don't get the authorization code.

What should we put in the code_challenge_method and code_challenge query parameters in Step 5 URL? Currently, we use the code_challenge_method=plain&code_challenge=code_verifier parameters and when we check the logs in <confluence_installation_directory>/logs/catalina.log file we didn't find any error in that so where we need to check the confluence logs for the above error.

8. When we use below authorization url and skipping code_challenge_method and code_challenge query parameters, then we get the authorization code and consent screen as well.

https://confluence.integ.us-west-2.beta.kendra.aws.a2z.com/plugins/servlet/oauth2/consent?client_id=7a8aeab250b334901ac54271d09e2fbc&redirect_uri=https://confluence.integ.us-west-2.beta.kendra.aws.a2z.com&response_type=code&scope=READ

9. When click on Allow button we get authorization code.

Authorization Code : 5f18a5e72580bad5e0d6b4983e97bacb

10. With the authorization code returned from the previous request, we can request an access_token with postman and in this step we get another error like 

"The server could not perform this operation - please check application logs."

when we check the logs in <confluence_installation_directory>/logs/catalina.log file we didn't find any error in that so where we need to check the confluence logs for the error.

Referring this documentation to setup OAuth2 Authentication on Confluence on-prem server.

we would appreciate if you could point us in the right direction on how to resolve this issue and set up the OAuth2 authentication on the Confluence on-prem server.