Using https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-protocols-oauth-code/, i was able to generate access token. But when i try to sent a message to skype bot using the access token generated using scopes defined in above url, i get a "401: The provided 'OAuth' ticket failed authentication." error. What scopes should i use while i generate a code or access token to sent a message to skype bot via API (https://docs.botframework.com/en-us/skype/chat/#rest-api ) . The scope specified here under skype/chat/#authentication does not even takes me to login page to generate code .
To generate a token you should do the HTTP call described in https://api.botframework.com/en-us/skype/chat/#authentication, i.e.
POST /common/oauth2/v2.0/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
client_id=<your bot msa app id>&client_secret=<your bot secret>&grant_type=client_credentials&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
So the scope is 'https://graph.microsoft.com/.default'.
Related
how can I exactly get google calendar resource list through service account?
Google docs (https://developers.google.com/admin-sdk/directory/reference/rest/v1/resources.calendars/list) states I need to send such request:
https://admin.googleapis.com/admin/directory/v1/customer/[CUSTOMER]/resources/calendars?key=[YOUR_API_KEY] HTTP/1.1 with header Authorization: Bearer [YOUR_ACCESS_TOKEN]
When I use Google API Explorer, then it asks me to login by my admin account and then returns list of resources. However when I try to do it manually, then I'm still getting Not Authorized to access this resource/api error.
I created service account, downloaded json file and then I'm trying this:
scope = 'https://apps-apis.google.com/a/feeds/calendar/resource/'
authorizer = Google::Auth::ServiceAccountCredentials.make_creds(json_key_io: File.open('path-to-service-account.json'), scope: scope)
authorizer.fetch_access_token!
Afterwards response looks like this:
{"access_token"=>"ya29.c.Kp8BFggA7me9IxxxxxxxxxxxxBGVdd0ezOTZqRMze7YH...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................", "expires_in"=>3599, "token_type"=>"Bearer"}
Not sure if I should use access_token with all those dots. However then I'm trying to do this GET request:
https://admin.googleapis.com/admin/directory/v1/customer/[CUSTOMER]/resources/calendars?key=[YOUR_API_KEY] HTTP/1.1
I set CUSTOMER as a short string like Cxxxxxx2x (found in console), but then I have a problem with key and Authorization.
Should key be value found in Google Console > Service Accounts > Service Account Key ID (around 40 letters in hex format)?
And then should I set Authorization: Bearer as access_token with or without dots? I found somewhere, that there should be access_token in path but as a jwt (access_token.as_jwt) but it is not working either.
Any ideas what I'm doing wrong when API Explorer works? :)
I'm using the OAuth Authorization Code flow to authenticate the user and authorize my application against the WSO2 Identity Server. I'm using a simple node/express server, with Passport.js, to get the Access Token, and Postman to use that Access Token to make a few test requests to the SOAP APIs.
When using a Bearer Token method to authorize my application, I get the following error in the IS logs: 0 active authenticators registered in the system. The system should have at least 1 active authenticator service registered. I get the following error in Postman: 500 Internal Server Error, with the following response body, <faultstring>Authentication failure</faultstring>.
Here is what it looks like in Postman:
The same Access Token works with a REST API request, like "https://localhost:9443/scim2/Me".
Can anyone tell me what I'm missing here?
SOAP APIs in WSO2 Identity Server cannot be authenticated with Bearer tokens. They can be authenticated with Basic authentication and cookies. That's the reason for getting Authentication failure in the response.
But REST APIs in the Identity Server can be authenticated with Bearer tokens. So /scim2/Me authenticate successfully with access token.
Try to get the Access token manually from Authorize service and use it
Step 1: Get authorization code
https://<is_server_url>:9443/oauth2/authorize?client_id=<id>&redirect_uri=<callback_url>&response_type=code&scope=openid
You will get an authorization code on the callback URL
Step 2: Call token service to get access token
Post https://<is_server_url>:9443/oauth2/token
Content-Type:application/x-www-form-urlencoded
Authorization:Basic <base64encoded "<client_id>:<client_secret>">
grant_type:authorization_code
scope:openid
code:<code_from_step_1>
redirect_uri:<callback_url>
exp:
client_id=**abcdefgh12345678**
client_secret=**xyzsecretkey**
callback_url=**http://locahost/callback**
scope=openid
server: localhost
base64encode(client_id:client_secret)= base64encode(abcdefgh12345678:xyzsecretkey) => YWJjZGVmZ2gxMjM0NTY3ODp4eXpzZWNyZXRrZXk=
GET https://localhost:9443/oauth2/authorize?client_id=**abcdefgh12345678**&redirect_uri=**http://locahost/callback**&response_type=code&scope=openid
it will make a request back to the callback url with a parameter code, lets say code=this01is02your03code, please check your browser address bar
POST https://localhost:9443/oauth2/token
HEADERS
Content-Type:application/x-www-form-urlencoded
Authorization:Basic **YWJjZGVmZ2gxMjM0NTY3ODp4eXpzZWNyZXRrZXk=**
BODY
grant_type:authorization_code
scope:openid
code:this01is02your03code
redirect_uri:http://locahost/callback
this will return an access token, let say token returned by the server is 12345678ASDFGH
Now you could use this token to call any RestFull or SOAP service
Authorization: Bearer 12345678ASDFGH
Using the Graph API and related authentication/authorization flows, how can I access data of all users in an organization? Also, multiple organizations/tenants need to be able to use the app.
As an example: I have an app which needs to read events from all calendars of all users under contoso.onmicrosoft.com. I would like that jack#contoso.onmicrosoft.com, the administrator, authorizes the app which will then be able to read the mentioned the data. Using the Managed API this can be easily done via impersonation.
However, I am trying to do the same with Graph API and OAuth, but I can't find a straight forward solution, or I must be missing something very obvious. I have created an app through manage.windowsazure.com (multi-tenant), and configured it so that it requires Microsoft Graph API (all application and delegated permissions).
I did the following:
1) Point jack#contoso.onmicrosoft.com towards https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&redirect_uri=<my redirect url>&client_id=<my client id>
2) Jack authorizes the app
3) I get back: <my redirect url>/?code=<my authorization code>&session_state=<blah>
4) I send a POST request like below:
POST https://login.microsoftonline.com/common/oauth2/token
Headers: content-type: application/x-www-form-urlencoded
Body:
grant_type=authorization_code&code=<my auth code from step above>
&redirect_uri=<my redirect url>
&client_id=<my client id>
&client_secret=<my client secret>
&resource=https%3A%2F%2Fgraph.microsoft.com%2F
5) When I do the following:
GET https://graph.microsoft.com/v1.0/users/jack#contoso.onmicrosoft.com/messages
Headers: Authorization: Bearer <auth token from step #4>
I get a 200 OK response with the messages.
When I do the following:
GET https://graph.microsoft.com/v1.0/users/anyotheruser#contoso.onmicrosoft.com/messages
Headers: Authorization: Bearer <auth token from step #4>
I get a 403 Forbidden response with:
{
"error": {
"code": "ErrorAccessDenied",
"innerError": {
"date": "2016-06-07T08:47:27",
"request-id": "5b629e30-e6bd-474d-b3dd-8ce25c5ad1c4"
},
"message": "Access is denied. Check credentials and try again."
}
}
The flow/URLs you've referenced are for the authorization code flow which leverages delegated scopes.
A) If you want the app to only work (i.e. access all calendars) for admins then you are using the right flow.
B) If you want the app to work for all users after the admin consents to it, you'll need to use the app (client credentials) flow and use application scopes. This means that you'll need to separate out consent from the regular auth flow.
For consent you'll need to to point the admin to the following url:
GET https://login.microsoftonline.com/common/oauth2/authorize?resource=https://graph.microsoft.com/&client_id=<YourClientId>&client_secret=<YourClientSecret>&response_type=code&redirectUri=<YourRedirectUri>&prompt=admin_consent
For auth flow you'll need a single call from your web server:
POST https://login.microsoftonline.com/common/oauth2/token
body resource=https://graph.microsoft.com/&client_id=<YourClientId>&client_secret=<YourClientSecret>&response_type=code
Or better yet, just use ADAL's AquireToken(resource, clientCredentials) overload.
Once that's done, your app should be good to go to make requests to Graph.
Regardless if you want to stick to A) or switch over to B), to double check that things are set up correctly you can:
Check the token that you get back from Graph (the one you attach to the request along with Bearer) and confirm that it has a roles entry with the roles you need i.e. Calendars.Read
NOTE: The following steps 2.a & 2.b require you to have admin to a test tenant where you'd be consenting to the application.
2.a Use GraphExplorer (https://graphexplorer2.azurewebsites.net/) and confirm that consent has been properly set up by querying
beta/servicePrincipals?$filter=displayName eq '[YourApplicationName]'
If nothing shows up, then the no one has consented to the application.
2.b (only applicable for auth code flow with delegated scopes) Use GraphExplorer and confirm that either delegation has been authorized correctly by querying
beta/oauth2permissiongrants?$filter=clientId eq '[IdFrom ServicePrincipal in 2.a]'
And ensuring you get either a result for the specific user in question or for "AllPrincipals".
More info on app vs delegated scopes here: http://graph.microsoft.io/en-us/docs/authorization/permission_scopes
More info on app flow here: https://graph.microsoft.io/en-us/docs/authorization/app_only
Please use the app-only auth flow (see https://graph.microsoft.io/en-us/docs/authorization/app_only) to use the application permissions - for the token request (step 4) you need to pass grant_type=client_credentials instead of grant_type=authorization_code.
I am trying exchange authentication code to access token on OAuth2.
I sent a request to google using GET request, and I got a code. And now I'm trying to exchange the code to access token.
I sent request to https://accounts.google.com/o/oauth2/token with these arguments
using POST request
code=[Authentication code]
client_id=[Client ID]
client_secret=[Client Secret]
redirect_uri=urn:ietf:wg:oauth:2.0:oob
grant_type=authorization_code
But google responsed like this with 400 error
{
"error" : "redirect_uri_mismatch"
}
I created Client ID on google developers console. I used type 'Installed Application'.
I also tried:
request_uri=#://localhost:8081
request_uri=#://localhost:8081/
(# means http. I edited on my phone, so I couldn't insert code block for http)
But it didn't worked.
What's wrong with request?
Check these 2 steps below
The redirect uri to retrieve auth code and access token should be same
Use the same redirect uri that you configured while creating the application, screenshot below
I am writing PHP API for Bit.ly using oauth2 for authentication. Their docs say that in order to retrieve access token with username and password we have 2 ways of achieving that:
Resource Owner Credentials Grants
HTTP Basic Authentication
I was successful only with the basic authentication method, the first method does not work for some reason.
What I did was using PHP cURL methods I appended to header authorization method which was following the docs:
Authorization: "Basic " + base64encode(client_id + ":" + client_secret)
And I also changed content type to:
Content-Type: application/x-www-form-urlencoded
After that I added parameters:
grant_type=password&username=bitlyuser&password=bitlypassword
And I am submiting the post request and I get:
INVALID_LOGIN
That error means the Bitly user name is incorrect. If you are positive it's correct, can you email me at api#bitly.com with the client ID and the user name?
Sometimes the actual user name may differ from what's displayed, if you signed up via Facebook or Twitter. You can find the actual login by going to your settings and clicking "Show Legacy API Key". (I'll file an issue to move that data outside the API key location.)