I understand that I need to call:
curl --request POST \
--url 'https://auth.atlassian.com/oauth/token' \
--header 'Content-Type: application/json' \
--data '{"grant_type": "authorization_code","client_id": "YOUR_CLIENT_ID","client_secret": "YOUR_CLIENT_SECRET","code": "YOUR_AUTHORIZATION_CODE","redirect_uri": "https://YOUR_APP_CALLBACK_URL"}'
to get access token. There is some attempt to explain what are client_id, client_secret, code, redirect_uri, but it's totally cryptic to me. Can someone explain to me, what these are and where to get them?
I can login to company jira. I can create my personal access token in my profile. I cant get any meaningful support from my company. I need to get somehow from here to access token, so that I can call rest api.
OAuth needs that the user login through a web interface.
Once logged, is possible to retrieve the code you are looking for in the URL.
In my case, in order to get that code I have to open the oauth login web page of the service I want to use (in your case atlassian) and just login.
I usually manage this process with code, not using curls.
redirect_uri is where you want to be redirected after you login in the web interface.
i.e. Do I need to login with atlassian in order to call api and use data from my app ?
mobile app/Desktop App (redirect_uri will be a schema defined by you in the app, could be something like: myCompany://myApplicationExample or with desktop http://localhost should work ). In this case I suggest you to read something about deeplink for applications.
website (redirect_uri will the url of your website : https://yourwebsite.com
In my case, with the services I usually work with, cliend_id and client_secret are given per user or per application, when requested to the company which provides services you need.
I hope this can help you clarify
BY THE WAY:
if you say you already have an Access Token , you should be able to do everything without Loggin in, because the final purpose of login and use all this parameters you asked for, is to get an Access Token.
The endpoint you are trying to call, will just return you an Access Token.
The Access token is what you need in order to call rest api in this case.
I would suggest you to try to call an atlassian rest API you want, using the Access Token you already have in the headers of the rest API, and see the results.
In my case, I have to create an header like this:
Authorization : Bearer {your Access token}
I hope this helps you.
EDIT:
As shown in point 1 in this doc https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/
you should open this url by your application:
https://auth.atlassian.com/authorize?
audience=api.atlassian.com&
client_id=YOUR_CLIENT_ID&
scope=REQUESTED_SCOPE_ONE%20REQUESTED_SCOPE_TWO&
redirect_uri=https://YOUR_APP_CALLBACK_URL&
state=YOUR_USER_BOUND_VALUE&
response_type=code&
prompt=consent
read the doc on you should set redirect_uri (http://localhost is valid if is a desktop application, but you will have to implement an http listener in order to get the authorization code, I suggest you to set a schema in you app or simply use a web page url).
You should get a client_id by atlassian to use in the url,same for scope.
I don't know exaclty the state parameter but in the docs should be writtend.
Once logged you will be redirected to the redirect_uri you set, getting also this authorization_code, then you can call the /token endpoint in order to get the Access Token.
curl --request POST \
--url 'https://auth.atlassian.com/oauth/token'
--header 'Content-Type: application/json'
--data '{"grant_type": "authorization_code","client_id": "YOUR_CLIENT_ID","client_secret": "YOUR_CLIENT_SECRET","code": "YOUR_AUTHORIZATION_CODE","redirect_uri": "https://YOUR_APP_CALLBACK_URL"}'
Here you have to use the authorization code you get from the login, re use the same client_id, set also the client_secret (should be given with the client_id) and re use the same redirect_uri you used in the login url.
Once done you will have finally the Access Token, which must be used in order to call Apis.
as shown in the doc you should be able to call apis like this curl
curl --request GET \
--url https://api.atlassian.com/oauth/token/accessible-resources
--header 'Authorization: Bearer ACCESS_TOKEN'
--header 'Accept: application/json'
Where 'ACCESS_TOKEN' will be your access token obtained before.
Remind that an Access Token usually has an expiration date, after which you will need to login again or refreshing the token.
EDIT 2:
A Client ID is an identifier associated with an application that assists with client / server OAuth 2.0 authentication.
So basically is a constant string, this should be given to you from atlassian/jira in some way.
Client Secret should be given to you with Client ID from atlassian/jira.
Client_id and client_secret usually are also called api keys.
Usually the Scope is the name of the application you are requesting api keys for (you should request new api keys for each application),this is up to you, and should be comunicated to the company in your case (atlassian/jira) when requesting api keys.
(i.e. For my company I work with Trimble Connect, which is just a platform, everytime I develop for example a plugin/addon on top of it I ask them new api keys)
for what concerns the state:
state: (required for security) Set this to a value that is associated with the user you are directing to the authorization URL, for example, a hash of the user's session ID. Make sure that this is a value that cannot be guessed. You may be able to generate and validate this value automatically, if you are using an OAuth 2.0 client library or an authentication library with OAuth 2.0 support.
In the beginning I would try to give the state a random value.
I think you should ask to Atlassian how to get your api keys (maybe there's a page for that, like for Trimble Connect in my case).
I would send them an e-mail.
Seems you are not interested in call Apis from an application you are developing, but just from curls.
if I'm right, I know I have already told you, but if I were you I would definitely try to call an atlassian API not trying to get the access token from the OAuth Login, but using that ACCESS TOKEN you told me you told me you manually created.
Please try this curl:
curl --request GET \
--url https://api.atlassian.com/oauth/token/accessible-resources
--header 'Authorization: Bearer {ACCESS_TOKEN}'
--header 'Accept: application/json'
just use your Access Token string instead of {ACCESS_TOKEN} and see the results.
I have a Firebase function that is triggered onRequest(), using the firebase-admin SDK and using Express as middleware. This function is not expected to be tied to a Firebase client/frontend (meaning, it is expected that this function can be called via curl -X POST ... etc.).
I want to secure this function such that only users with access to the Firebase project can make requests. I've found Firebase ID Tokens, and see how to create them on the client side.
My issue is that I don't have a client to create them from.
Is there a way to create an ID Token for an authorized user using the CLI, or another similar method?
E.g., something like
firebase login
firebase use <project-id>
firebase generate-id-token // would return an ID token with standard expiration rules.
There isn't a command in Firebase CLI to login as a user and print ID token. You can call Firebase Auth REST API using cURL and get the token.
curl --request POST \
--url 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=[FIREBASE_API_KEY]' \
--header 'Content-Type: application/json' \
--data '{
"email": "user#domain.tld",
"password": "12345678",
"returnSecureToken": true
}'
I want to secure this function such that only users with access to the Firebase project can make requests.
Anyone can use the REST API but they must know the account's password to login.
i am new to keycloak.
I have made web portal that authentication (login, logout,forgot password) of users is done in backend ( PHP ) using REST Api. After successful authentication user is allowed to enter secure part of portal.
I am having trouble to get REST API endpoint so that when user is logged in i would like to get a list of permissions that this user have so i can render the UI with functions that specific user have permissions to. So far i found endpoint which can ask for specific permission only
curl -X POST http://$URL/auth/realms/argo/protocol/openid-connect/token -H "Authorization: Bearer $TOKEN" --data "audience=$CLIENTID" --data "permission=$PERMISSIONNAME#$PERMISSIONSCOPE"
Is this possible with keycloak ? I would have maybe around 10 navigation functions and some will be payable so once user buys this function we will allow this permission to this specific user.
Thanks
I spent a lot of time to make it work.
Basically, once the user is logged in (via a JWT access token) your app has to issue an additional call to an OIDC endpoint, in order to get an extended JWT token (including fine grained permissions).
Here are the details of this extra call:
POST http://server:port/auth/realms/<realm>/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded
Authorization: "Bearer ....." (=access token of logged-in user)
Parameters:
- grant_type: the constant "urn:ietf:params:oauth:grant-type:uma-ticket"
- audience : the keycloak client id
- response_include_resource_name: true
You will get in response a JWT token that should be decoded
either programatically (quite easy)
or by invoking Keycloak token introspection endpoint (ie /auth/realms//protocol/openid-connect/token/introspect
And, once decoded, you will notice that the json payload contains an extra "authorization" node.
I am trying to get an oAuth token manually for social login so that I can test some functionality in the backend of my app - namely calling some REST APIs by mocking a user that has logged in via Secure Social Login (SSL). This involves calling <oAuth tenant url>/api/v2/userinfo. I began looking at the Authorization Code Flow but this requires an /authorize call which redirects rather than returns an access_code (for example).
So then I thought that the Token Exchange for Native Social documentation would be how to do so but I'm not sure about some of the parameters.
curl --request POST
--url 'https://YOUR_DOMAIN/oauth/token'
--header 'content-type: application/x-www-form-urlencoded'
--data 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=SUBJECT_TOKEN&subject_token_type=SUBJECT_TOKEN_TYPE&client_id=YOUR_CLIENT_ID&audience=API_IDENTIFIER&scope=SCOPE'
}'
subject_token: Externally-issued identity artifact, representing the user.
subject_token_type: Identifier that indicates the type of subject_token. Currently supported native social values are: http://auth0.com/oauth/token-type/apple-authz-code.
I thought that the subject_token could be the user_id from the resource, e.g. google-oauth2|122013643367342457857 but I am not at all sure what the subject_token_type should be. The application (in oAuth) is a 'Single Page Application'.
I am trying to work with IAM token based authentication. I am able to generate 'access token' and could do operations using the 'access token'. Now I am having issue while generating 'refresh token'. I am following this link https://cloud.ibm.com/docs/services/watson?topic=watson-iam.
I am using below command to generate refresh token. Here Authorization header value obtained using username as 'apikey' and value as my key. {refreh-token} value I am using which I received while generating 'access token'.
curl -k -X POST --header "Authorization: Basic Yng6Yng=" --data-urlencode "grant_type=refresh_token" \ --data-urlencode "refresh_token={refresh-token}" "https://iam.bluemix.net/identity/token"
I expect to get refresh token but get error {"context":"requestId":"021c3482...""},"errorCode":"BXNIM0507E","errorMessage":"For OpenID Connect related APIs, you need to send your client credentials as basic authorization header"}
Can some one help me in understanding what is going wrong
The description in https://cloud.ibm.com/docs/services/watson?topic=watson-iam is incorrectly describing the refresh case. I will follow-up with the docs team to update that section.
This is the generic description how to get tokens for API keys:
https://cloud.ibm.com/docs/iam?topic=iam-iamtoken_from_apikey
For API usage, IBM Cloud allows you to generate access token's without providing a client id / secret. In this case, a default client id is assumed which is only allowed to create tokens for API keys, but not authorized to use any other grant type - including the grant_type refresh_token. Therefore, simply dismiss the refresh token from the response of the API key grant in the first call - you won't be able to use it.
In the API key use case, there is no benefit of using the grant_type refresh_token over getting a new access token with the API key grant type anyway - all validation steps that are done internally (does the user stil exist / is the user still in the account / ...) are identical. But the refresh token eventually will expire - the API key not.