Adobe Analytics API v 2 - api

Question

A little baffled by the Adobe Analytics Oauth integration. I have done many OAuth implementations with other providers in the past, and used the older versions of the Adobe Analytics API.
My company provides services to clients who use Adobe Analytics, we do not have an account of our own. In the past we just needed to be provided the user and shared secret and we were good to go. Now it seems that we need to have an integration created by an admin in the client company, and have them send us the client_id and client_secret securely. This does not grant us access instead it is the first step in requesting access. Once we have this information we can do an OAuth request, using a valid adobe id with proper access and then we will receive the token we need to request data.
With other OAuth integrations I have seen, the client_id and client_secret are not tied specifically to a given account, but rather to the application. In this case it seems we will need to have a new set of client_id and client_secret created for one application, for each account we need access to.
To clarify the use case.
I work for Define Media Group an Audience Development Consulting Firm
specializing in SEO.
Many of our clients are news organizations, for our purposes here,
lets say our client is the fictitious Newscor. Newscor uses Adobe
Analytics and has come to us to provide insight into how they can
improve their SEO performance.
As part of our analysis of Newscor we will need to look at the
Analytics data for all of the requests to their site from Googlebot.
We will use the Adobe Analytics Reporting API to retrieve this data
and perform our analysis.
In the case of a second fictitious company, Newscom, who instead used
Google Analytics, I built an application, I logged in with a Define
Media Group account to the Google API Console and generated a service
account for my application. This provided the client id and secret
needed for completing the OAuth process. Now I just need to have our
SEO contact at Newscom, access our page and complete the OAuth process
with his credentials and I will be able to complete the analysis on
his behalf. Very straight forward.
In the case of Newscor, I am stuck. I have asked my SEO contact at
Newscor to have a service account created and provide the client id
and secret. Instead he provided me his username and password. I told
him that was not what I needed and would not work, confused he has a
user account created for me, and again I have to inform him that this
will be useful, but is not what I need. I send over a link to the
Adobe documentation on how to create an integration account, before
following those directions I am sent a few other random strings of
characters in hopes that one of them will give me the data I need.
Finally, the integration account is created and the client id and
secret are pasted into an email and sent to me over SMTP, plain text
you know. Because users understand security and the complex side of
OAuth, so it is totally reasonable to have them sending client
secrets.
Yes the old credentials were also broken, I thought perhaps, a new API
based on a community standard would resolve that, instead it seems to
have made it worse. Instead of sending me one set of credentials he
has to send me two sets, the client id and secret and a username and
password for an adobeid. The idea behind OAuth as I understand it was
to entirely eliminate this and require that they send me no secrets,
but rather visit a secure page and grant me authorization through the
OAuth process, a familiar login and a few clicks, with secure exchange
of information. The OAuth client_id were between me and Adobe where I
was able to download that information through Adobe's secure website.
That same client_id and secret will be used when Newscom converts to
Adobe Analytics, or another client comes to us with an Adobe Analytics
account.
Avoiding third parties needing to exchange secrets is a primary reason that Oauth exists. Requiring exactly that exchange makes this less secure than a username and password alone.
Posting here, because that is where Adobe directs people to ask questions.
Is this really the way that the new Adobe API works for OAuth or is there something I am missing?
Does it seem reasonable to expect each client to generate a new application integration?

Answer 1

Does it seem reasonable to expect each client to generate a new
application integration?
Well this is just opinion, but yes, I do think it is reasonable to expect each client (Company) to generate their own application Integration.
FYI, the previous user/shared secret you are used to is also tied to an individual adobe analytics account, and is also something the client would have had to setup and provide.
In this case it seems we will need to have a new set of client_id and
client_secret created for one application, for each account we need
access to.
I'm not sure I understand what you mean by this. What exactly are you looking to do with your app? For example, if you are using the Adobe Analytics Reports API, you have the Integration credentials + Your own credentials and you can make Report requests with just that. You do not need credentials for any other user account.
Or, if you have a web interface, you have the option to have the users authenticate with their own credentials.
Overall, the Integration is the middle-man between the Adobe APIs and the user(s) requesting them. The users use their own credentials that they should already have.
Here is an example of it in action (press the login button at the top of the page): https://adobedocs.github.io/analytics-2.0-apis/
Under the hood, there is only one Integration setup, and any individual authenticates with their own Adobe ID login credentials, and what they can actually do within the app depends on what kind of permissions their Adobe ID has for that company.
Perhaps it would be easier to explain the flow if you provide example of what your app actually does?