I first asked this question over at https://community.auth0.com/, but
re-iterating here to reach a wider audience,
https://community.auth0.com/t/machine-to-machine-dynamic-application-registration/96639
I'm wondering, how can I specify a dynamically created client as type Machine-to-Machine (for use with an API) at creation time? My high-level goal is to allow developers the ability to create their own applications, then use the client credentials flow to access information via a resource server, as per OIDC spec.
Seems like every approach requires me to manually update a "Generic" dynamic application. For instance, I can do something like
curl --request POST \
--url 'https://<tenant>.us.auth0.com/oidc/register' \
--header 'content-type: application/json' \
--data '{"client_name":"My Dynamic Application","redirect_uris": ["https://application.example.com/callback", "https://application.example.com/callback2"] }'
But then it defaults My Dynamic Application to type "Generic". Ideally, i'd like to specify something like { "app_type": "m2m" }, and be able to "extend" the functionality of the oidc/register endpoint.
Related
I'm trying to import an xml report to Jira xRay - to a Test Execution item.
The documentation I can find makes reference to client_id and client_secret, which should be generated by Create API key. Create API key only generates one string, a token.
As such I can't figure out how to use just the token to submit the xml report.
For example, this command:
curl -H "Content-Type: application/json" -X POST --data #"cloud_auth.json" https://xray.cloud.getxray.app/api/v2/authenticate
I can't use it, as it needs client_id and client_secret. Also, the endpoint itself returns
Cannot GET /api/v2/authenticate
.
Using this command:
curl -H "Content-Type: text/xml" -X POST -H "Authorization: Bearer $token" --data #"data.xml" https://xray.cloud.getxray.app/api/v1/import/execution/junit?testExecKey=XNP-23
from: https://docs.getxray.app/display/XRAYCLOUD/Import+Execution+Results+-+REST#ImportExecutionResultsREST-JUnitXMLresults
results in "{"error":"Invalid JWT: JsonWebTokenError: jwt malformed"}"
.
Please can anyone help?
first you need to clarify if you're using Xray on Jira server/datacenter or Jira Cloud, because they are different products and have slightly different APIs; besides Jira Cloud and Jira server/datacenter are also different products. To find out, you can ask your Jira admin for example.
If you’re using Xray Cloud, then this is documentation site.
In this case, in order to submit the JUnit XML report you need to make an authencation with a client id and client secret that you obtain on Xray API Keys section. The authentication request is detailed here, and that will return a token that you'll use on the second request.
The second request is an HTTP POST, as described here, and you need to pass the token obtained earlier.
The main REST API documentation site is this one.
If you’re using Xray on Jira server/datacenter, then this is proper documentation site.
In Xray server, the authentication mechanism is provided by Jira itself.
You can either use basic authentication or Personal Access Tokens (if you have Jira >= 8.14). This is detailed on Xray server/datacenter page dedicated to its REST API.
After choosing the authentication mechanism to use, you just need to make a HTTP POST request as detailed here.
There is an open-source GitHub project with some code snippets, both for Xray server/datacenter and cloud, using different test automation report formats and different authentication mechanisms.
I have faced the same error when I tried with postman, I have removed " from generated token from start and end position and passed token to API. That resolved this issue
Truly grateful for any help here:
Trying to trigger a Twilio Studio flow from Zapier but with no luck so far.
Here is the Twilio guidance on how to trigger an execution: https://www.twilio.com/docs/studio/rest-api/v2/execution
Here, for example, is how the required data looks as CURL (those phone numbers are not real don't worry):
curl -X POST https://studio.twilio.com/v2/Flows/FWXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/Executions \
--data-urlencode "To=+15558675310" \
--data-urlencode "From=+15017122661" \
-u $TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN
The required data is: To and From as well as the TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN authentication.
I would also like to pass through some data under Parameters as shown in this bit.
So the first step was the auth: Zapier was saying: "The app returned Authentication Error - No credentials provided".
Based on some other info, I have got past this (I think) by putting the Account SID and Auth token in the URL itself like this:
https://TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN#studio.twilio.com/v2/Flows/FWXXXXXXXXXXXXXXXXXXXXXXXXXX/Executions
(Maybe better/neater to put with the parameters, let me know)
But after the problem is now passing in the To, From and Parameters.
"The app returned Missing required parameter To in the post body".
Here is how my Webhook Zap currently looks
Thanks you for any help!
You need to use Form as Payload Type:
For the basic authentication to work make sure to use a | to separate the username and password:
I'm trying to find a way to restrict the access to each of the buckets in my application. The goal is to prevent users to access objects from other buckets other than the one which is "assigned" to them.
In short the app assigns a bucket for every user to store objects within and I want to prevent users to access buckets which are not meant to be accessed by them.
I guess a request could look like this:
curl -v 'https://developer.api.autodesk.com/authentication/v1/authenticate'
-X 'POST'
-H 'Content-Type: application/x-www-form-urlencoded'
-d '
client_id=obQDn8P0GanGFQha4ngKKVWcxwyvFAGE&
client_secret=eUruM8HRyc7BAQ1e&
grant_type=client_credentials&
scope=data:read&
# I'm thinking for some parameter like this
bucket=CLIEN_SPECIFIC_BUCKET_ID
'
You should implement your own management layer of your app to manage user permissions to different buckets - per best practice user should not be exposed to app level access tokens to access the buckets themselves.
Forge cloud buckets to Forge app and not end users as it’s a development platform and operates on developer/application levels and rather than those of end users.
EDIT:
For Viewer you can go with an AOP approach and set up a proxy in your backend and delegate authentication to the proxy - you can redirect Viewer to send requests to your endpoints to retrieve resources and your backend can in turn authenticate and retrieve the resource from Forge services so that you won’t have to expose your access token to the users. Try:
Autodesk.Viewing.endpoint.setEndpointAndApi('https://yourhostname/your/proxy/service/path')
And you can add custom headers to Viewer’s requests to authenticate against your own app:
Autodesk.Viewing.endpoint.HTTP_REQUEST_HEADERS = {}
Alternatively you can download the derivatives to your own storage and load them from there - see here for details.
So I want to tweet on Twitter by sending a POST request to the Twitter API.
I have not found a simple way to do this (unless I use a wrapper), and I'm not too experienced with Lua.
This is Twitter's own example using curl:
$ curl --request POST
--url 'https://api.twitter.com/1.1/statuses/update.json?
status=Test%20tweet%20using%20the%20POST%20statuses%2Fupdate%20endpoint'
--header 'authorization: OAuth oauth_consumer_key="YOUR_CONSUMER_KEY",
oauth_nonce="AUTO_GENERATED_NONCE", oauth_signature="AUTO_GENERATED_SIGNATURE",
oauth_signature_method="HMAC-SHA1", oauth_timestamp="AUTO_GENERATED_TIMESTAMP",
oauth_token="USERS_ACCESS_TOKEN", oauth_version="1.0"'
--header 'content-type: application/json'
But from some wrappers I've seen, it seems that you can use:
consumer_key
consumer_secret
access_token
access_token_secret
I just want a simple way of tweeting without being able to have all of the other API functionality that the Twitter API has. So no wrapper or anything. Just a simple script, but I can't seem to figure it out. Any help is greatly appreciated.
Use a specialized Lua library for Twitter, e.g. https://github.com/leafo/lua-twitter
luarocks install https://luarocks.org/manifests/leafo/twitter-dev-1.rockspec
or a more general Lua library for OAuth, e.g. https://github.com/ignacio/LuaOAuth and do the rest yourself.
I am basically trying to implement a User authentication system that POSTs information to an API/Web Service to cross-reference credentials, therefore rejecting them or allowing them to login.
I am not sure if I understand how this whole system works exactly, but I have been researching a lot on Authentication using Devise and APIs, and do not understand how none of the examples refer to the actual URI of the API at all.
For example, when I first began this process, I made sure to be able to connect to the web service through cURL:
curl -H "Content-Type: application/json" -d '{"RuntimeEnvironment":1,"Email":"someone#example.com","Password":"Pa$$worD"}' -X POST http://blahblah/WebService/AuthenticateLogin
However in every single blog post / tutorial / guide / StackOverflow question I have been on, literally none of them specifically refer to the http://blahblah/WebService/AuthenticateLogin as I did in my cURL request.
Am I searching for the wrong thing?
Or is it actually there and I'm just not understanding?
Also how do tokens factor into this scenario?
The web service I am using does not require/return a token.