I am trying to create Test Automation framework for Apipgee Proxy URLs.
I am using Rest Assured Framework for Apigee proxy URLs with generating Bearer token on the fly ,Xapi Keyand use Apigee proxy URL. For now token is generated manually using CURL command . I can test well in postman.
// accessToken,apiKey below is defined as string
// inputrequest.getInputStream() reads JSON needed for body
response= RestAssured
.given()
.headers("Authorization","Bearer "+ accessToken)
.headers("apiKey", apiKeyVar)
.contentType("application/json")
.body(inputrequest.getInputStream()).When()
.post(apigeeProxyURL).then().statusCode(200).extract().response();
I am getting 401 (Unauthorized error) instead of 200. My query here to summarize--
Does RestAssured Framework Supports Apigee Proxy URL .
if same x-api Key and Bearer token works in postman for same end point, why its throwing an error
I read some blogs with variation on how to pass x-api Key and Bearer Token
Please revert back and share directions on how to approach for REST API Automation for Apigee Proxy URLs
Thanks and Regards,
Aditya Mandlekar
Check if you are passing the apikey at the correct place . By default it should pass in the query param. Check your verifyapikey policy which you must have attached to your proxy.
Related
I'm trying to get the access token using an http request.
According to the Oauth guide:
https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth
the endpoint for exchanging authorization code to access token is https://oauth2.googleapis.com/token but it gives a page can't be found HTTP 404 error
Here's my entire url (I've replaced the code, client id, and secrets)
https://oauth2.googleapis.com/token?
code=xxxxx&
client_id=xxxxx&
client_secret=xxxxx&
redirect_uri=http://localhost&
grant_type=authorization_code
It looks like you are passing in the required fields as query parameters, but you need to put them in the post body and send an HTTPS POST request to https://oauth2.googleapis.com/token. You can find this information further down in the documentation you were referring to: https://developers.google.com/identity/protocols/oauth2/web-server#httprest_7.
I'm in the context of an embedded devices that uses an HTTPS client to request an access token on behalf of a user (delegated permission needed for the app).
I'm currently using OAuth 2.0 ROPC (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc) to get my token and everything works fine.
But since this authentication is deprecated I'd like to change to a more secure solution that works in hybrid identity federation scenarios.
I see that many other solutions exists, but I can't find one that doesn't need to interpret an HTML/JS response.
Here a CURL example to explain my point:
ROPC request:
curl -X POST "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token" --data "grant_type=password&scope=EWS.AccessAsUser.All&username=<username>&password=<password>&client_id=<client_id>&client_secret=<client_secret>" -H "Content-Type: application/x-www-form-urlencoded"
Response:
{"token_type":"Bearer","expires_in":3599,"ext_expires_in":3599,"access_token":"eyJ0eX....1234"}
Here I can extract the token directly from the response.
But using other ways to get delegated permission token such as OAuth 2.0 Implicit Grant flow (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow), responses are always an HTML that I can't interpret.
So here I am wondering if there is a solution to this situation.
Thanks in advance,
Aloïs KYROU
You cannot use the implicit flow to obtain the token in the tool, you can only run the request url in the browser. Because using the implicit flow requires you to log in. Please note that before this, you must enable id token and access token.
Request the id token and access token in the browser.
https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize?
client_id={client id}
&response_type=id_token token
&redirect_uri={redirect_uri}
&scope=openid EWS.AccessAsUser.All
&response_mode=fragment
&state=12345
&nonce=678910
I am trying to integrate Power Automate (Workflow service) with SmartSheet using OAuth 2.0
I have got the auth code successfully and when I finally try to get the token, it throws the message - 'You are not authorized to perform this action.' with error code 1004
I tried in Postman with the same result.
I believe the problem is that you're specifying all 5 values via the Request Header. Only Content-Type is specified via the Header -- the other four parameters (client_id, client_secret, code, and grant_type) should be specified via the query string. You're getting the not authorized error because Smartsheet is looking for the value of client_id etc. in the query string but not finding it there.
For example, here are screenshots from Postman that show setting Content-Type via the Headers and the other four parameters via the Params:
I am trying integrate Devops with another 3rd part system, but i tried to access Devops from postman using oAuth2.0, but it is always failing, throwing me a error {"Error":"invalid_client","ErrorDescription":"Invalid client auth token."}
Does Devops support oAuth? if so what i am missing so i got this error?
The problem is that DevOps is using non standard headers for some reason. This causes the built in postman to not work. The way that I figured out to work around this is to input the Auth url directly into your browser. You can then extract the auth code from the callback URL.
Then with that code, make a post to the token endpoint in postman
https://app.vssps.visualstudio.com/oauth2/token
Use x-www-form-urlencoded body and fill out the following keys
"client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
"client_assertion", your app secret
"grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"
"assertion", your auth code from previous step
"redirect_uri", your callbackurl
Azure DevOps supports oAuth. If you follow the steps in the link below to get an oAuth token, and type the token directly in Postman, you'll get a successful response:
https://github.com/Microsoft/azure-devops-auth-samples/tree/master/OAuthWebSample
I want to use OAuth2 authentication in my application for calling Eloqua APIs using access token.
I'm following instructions given in the link http://docs.oracle.com/cloud/latest/marketingcs_gs/OMCAB/Developers/GettingStarted/Authentication/authenticate-using-oau… and using Resource Owner Password Credentials grant flow for getting access token.
POST https://login.eloqua.com/auth/oauth2/token
Authorization: Basic Q09NUEFOWVhcdXNlcjE6cGFzc3dvcmQxMjM=
{
"grant_type":"password",
"scope":"full",
"username":"testsite\\testuser",
"password":"user123"
}
But I'm getting exception "java.net.ConnectException: Connection timed out: connect" while calling get token endpoint https://login.eloqua.com/auth/oauth2/token from java code.
I tried the endpoint using browser but getting similar error. Also tried accessing the endpoint using REST client but again same connection error.
I'm unable to understand that why the endpoint is giving connection timeout exception. I also tried increasing timeout but same error.
Please guide me as I'm stuck.
Is there any other endpoint for getting Eloqua access token?
Below is a POSTMAN Screenshot in case it helps.
Also written out in case someday that screenshot isn't there. Don't use built in Auth in POSTMAN since you need to base64 encode the clientid:clientsecret with the : in the middle. These values are provided when you created an App in Eloqua.
Be sure to include the content type as application/json and the Authorization. Use a double backslash in the Json for the username in between the site and username (clientsite\\username).
JSON body should look like this:
{"grant_type":"password","username":"clientsite\\username","password":"password"}
Make sure you are doing a POST to login.eloqua.com/auth/oauth2/token
From the docs:
POST https://login.eloqua.com/auth/oauth2/token
Authorization: Basic Q09NUEFOWVhcdXNlcjE6cGFzc3dvcmQxMjM=
{
"grant_type":"authorization_code",
"code":"SplxlOBeZQQYbYS6WxSbIA",
"redirect_uri":"https://client.example.com/cb"
}
From your request, it looks like you are missing the redirect_uri and the code.
Try using the body contract from the docs: http://docs.oracle.com/cloud/latest/marketingcs_gs/OMCAB/index.html#Developers/GettingStarted/Authentication/authenticate-using-oauth.htm