Skip to main content

Trying out OAuth2 Authorization Code grant with WSO2 Identity Server without the PlayGround2 App



The first thing I did after joining the WSO2 Identity Server team was to test the WSO2 Identity Server 5.2.0-beta pack. I had some experience playing around with OAuth so I started testing OAuth scenarios. I was able to test most grant types with ease. Then came the authorization code grant type. The usual way to test it was to setup the playground2 app and test. I wanted to look for an alternate way to test the Authorization grant type without setting up the app (partly because I was lazy to download tomcat etc. :P )

So with the help of my team member Pushpalanka, I found an alternate way to get an access token by simply using a browser redirect and a curl command. So I wanted to make a note in case someone wanted to do the same :)


1. First, log in to the Identity Server management console.
       the defaults are,
                  username = admin
                  password = admin

2. Go to the Service Provider configuration page and create a Service Provide, let's say SP_lazy :)

3. Go to the Inbound Authentication Configuration setting and enable OAuth/OpenID connect


4. Provide the callback_url as "https://localhost/callback"


5. You can type the following in a browser (better to try in an incognito/private window)

https://localhost:9443/oauth2/authorize?response_type=code&client_id=<cliend_id>&redirect_uri=https://localhost/callback&scope=read
  

6.  You will be prompted to log in and thereafter approve to authorize the SP


you can use the same account you used to log in or any other valid user from the same tenant. (If u you want to allow users from other domains you need to enable SaaS enabled in the Service Provider Inbound Authenticator OAuth configuration)


7. Once you do that you will be redirected and you can find the code in the browser.


8. Copy the code value and use the CURL command below to send a request to the token endpoint to get an access token

curl -k -v --user <client_id>:<client_secret> -d "grant_type=authorization_code&code=<authorization_code>&redirect_uri=https://localhost/callback" https://localhost:9443/oauth2/token 


9. You will get the access_token in the terminal like below,

{"access_token":"22630eaee65fef254e9cd099a96cf793","refresh_token":"ef18653c6b109887d66356254abd09fb","scope":"read","token_type":"Bearer","expires_in":3600}



  

Labels:

Comments

Post a Comment

Popular posts from this blog

OAuth - Playing Ping Pong for Authorization

You probably would have heard the word OAuth more than a few times. Ever wondered what that is? do we use that at all?. Guess what we make use of OAuth almost everyday.I got the opportunity to learn about OAuth during my time at WSO2 Identity Server team. Here's the first step of conquering OAuth :) What Exactly is OAuth? Let me start with OAuth,  OAuth solves the problem of allowing third party entities( eg: applications) to access a resource owner's protected resources without actually giving away your valuable credentials like passwords.  Let's think of it this way. You have a facebook account(Assuming you have one :P) which is your protected resource and you are the resource owner . Now you get a little high and decide to try out one of these fancy Facebook apps that finds your soul mate. The app now becomes the third party application which requires access to read out your friend list from your profile which is the protected resource. Suppose you don't ...
5 comments
Read more

Configuring WSO2 Identity Server to return Attribute Profile claims in SAML SSO Response

Configuring SAML SSO for an external Service Provider with WSO2 Identity Server is probably one of the most common use cases I heard from my day 1 at WSO2. Setting up is quite easy, Just follow the docs here . Now let me start from there, what if someone wants to retrieve certain claims of a user in the SAML Response. How easy is it to configure that? Well, Let me show you :) Step 1 Assuming that you have setup a Service Provider in Identity Server by following the docs, you should have a configuration like the one below, The most important part of this config is the " Enable Attribute Profile " tick, that allows you to get a set of pre-configured claims in the SAML response. Be sure to have it ticked. Step 2 Now your are done with Step 1, In Step 2 you simply configure the claims that you want to be returned in the SAML response. To do this, Go to the " Claim Configuration " section of the service provider, Now click on " Add Claim ...
1 comment
Read more

OAuth2 Authorization Code flow without client secret using WSO2 Identity Server

Quoting from  https://aaronparecki.com/oauth-2-simplified/ Single-page apps (or browser-based apps) run entirely in the browser after loading the source code from a web page. Since the entire source code is available to the browser, they cannot maintain the confidentiality of their client secret, so the secret is not used in this case. The flow is exactly the same as the authorization code flow above, but at the last step, the authorization code is exchanged for an access token without using the client secret .  Note: Previously, it was recommended that browser-based apps use the "Implicit" flow, which returns an access token immediately and does not have a token exchange step. In the time since the spec was originally written, the industry best practice has changed to recommend that the authorization code flow be used without the client secret. This provides more opportunities to create a secure flow, such as using the state parameter. References:  Redhat ,...
Post a Comment
Read more