Hello,

I am using Liferay 7.3 GA6, using the OAuth 2 administration panel I have configured an application as the following image.

Then I have tried to perform the following graphql calls.

1. Obtain the oauth2 token (success)

curl --location --request POST 'https://<host>/o/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=id1234' \
--data-urlencode 'client_secret=secret1234' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=<emailaddress>' \
--data-urlencode 'password=<password>'

I have replaced real data with <fake data>.

This operation is successfull and I obtain the access token and the refresh token.

2. invoke the graphql operation (failed)

curl --location --request POST 'https://<host>/o/graphql' \
--header 'Authorization: Bearer 9c7222375513be53a5ef5be5471961d9a3627c1e27ab8aceb92edc43218ea' \
--header 'Content-Type: application/json' \
--data-raw '{"query":"{\n site(siteKey: \"38413\"){\n id\n name\n }\n}","variables":{}}'

Reading the documentation I see that the access token should be passed through the authorization header. Anyway I obtain the following error

{
    "errors": [
        {
            "message": "Exception while fetching data (/site) : java.lang.SecurityException: Access denied to com.liferay.portal.kernel.service.GroupService#getGroup",
            "locations": [],
            "errorType": "DataFetchingException",
            "path": null,
            "extensions": {
                "exception": {
                    "errno": 401
                },
                "code": "Unauthorized"
            }
        }
    ],
    "data": {
        "site": null
    }
}

Can anyone help me on this please?

Thanks,
Graziano