Authorization Code flow description - Revision history

Alexei.baranov at 09:19, 7 September 2020

2020-09-07T09:19:42Z

Alexei.baranov: /* Overview */

2020-07-17T09:01:14Z

‎Overview

Alexei.baranov at 09:00, 17 July 2020

2020-07-17T09:00:58Z

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-07-09T08:14:16Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-07-09T08:14:05Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-06-02T11:37:20Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-05-29T10:18:26Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-05-29T10:17:47Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Authorization Code flow by i2Rest command */

2020-05-29T10:15:39Z

‎Authorization Code flow by i2Rest command

Pavel.lobko: /* Overview */

2020-05-29T09:45:48Z

‎Overview

@@ Line 1: / Line 1: @@
-{{DISPLAYTITLE:Authorization Code flow using i2Rest bridge mode description}}
+{{DISPLAYTITLE:Authorization Code flow using i2Rest bridge mode}}
 ==Overview==
 Authorization Code flow using i2Rest bridge has not too much diferencies from [https://tools.ietf.org/html/rfc6749#section-4.1 original Authorization Code flow]  - we just have to implement two "bridges" to solve IBM i functional limitations. Here are limitations and  our solutions:

@@ Line 3: / Line 3: @@
 Authorization Code flow using i2Rest bridge has not too much diferencies from [https://tools.ietf.org/html/rfc6749#section-4.1 original Authorization Code flow]  - we just have to implement two "bridges" to solve IBM i functional limitations. Here are limitations and  our solutions:
-- i2Rest Client is not capable of interacting with the resource owner's user-agent (typically a web browser), this functions are delegated to the i2Rest Server. To perform the delegation i2Rest Client have to provide i2Rest Server with all the necessery request details and bring the end user's agent to i2Rest Server Bridge endpoint. This process is described in steps A-B-C on the scheme bellow.<br>
+* i2Rest Client is not capable of interacting with the resource owner's user-agent (typically a web browser), this functions are delegated to the i2Rest Server. To perform the delegation i2Rest Client have to provide i2Rest Server with all the necessery request details and bring the end user's agent to i2Rest Server Bridge endpoint. This process is described in steps A-B-C on the scheme bellow.<br>
-- i2Rest Client also  is not capable of receiving incoming requests via redirection, so I2Rest Server have to receive Authorization Server redirection with access code attached. Then obtained access code should be linked to initial I2Rest Client to Server communication, and returned to the Client uppon request. The process is described in steps G-E-H on the scheme bellow.<br>
+* i2Rest Client also  is not capable of receiving incoming requests via redirection, so I2Rest Server have to receive Authorization Server redirection with access code attached. Then obtained access code should be linked to initial I2Rest Client to Server communication, and returned to the Client uppon request. The process is described in steps G-E-H on the scheme bellow.<br>
 [[File:Bridge flow scheme.png|700px]]

@@ Line 58: / Line 58: @@
 |-
 |}
-i2Rest command example bellow represent request for Google Drive file list, please explore [[Authorization_code_usecase_1|the appropriate use case]].
+i2Rest command example bellow represent request for Google Drive file list:
 <pre>
 I2REST COMMAND(*GET)
@@ Line 76: / Line 76: @@
         BRIDGEPW('<Client password>')
 </pre>

@@ Line 75: / Line 75: @@
         BRIDGEID('<Client name>')
         BRIDGEPW('<Client password>')
 </pre>

@@ Line 60: / Line 60: @@
 i2Rest command example bellow represent request for Google Drive file list, please explore [[Authorization_code_usecase_1|the appropriate use case]].
 <pre>
 I2REST COMMAND(*GET)
-        URL('https://www.googleapis.com:443/drive/v3/files')
+        URL('https://www.googleapis.com/drive/v3/files')
-        OUTPUT(*JOBLOG)
+        OUTPUT(*BOTH)
         DCMCLIENT(MYCLIENT)
         AUTHMETHOD(*BRIDGE)
-        AUTHID('677815701888-aj80fure8f1laqd3dqvpqtmlandni5an
+        TOKENS('/qsys.lib/qtemp.lib/tokens.usrspc')
-              .apps.googleusercontent.com')
+       AUTHID('Device ID')
-        AUTHPW(tI2ezmVGioGwrGk9K2O23Mv5)
+        AUTHPW('Device password')
         AUTHURL('https://accounts.google.com/o/oauth2/v2/auth
                 ')
         TOKENURL('https://oauth2.googleapis.com/token')
         SCOPE('https://www.googleapis.com/auth/drive.file')
-        BRIDGEURL('https://api.i2rest.com:22089/a2d')
+        BRIDGEURL('<Bridge endpoint>')
-        BRIDGEID(OAUTH21)
+        BRIDGEID('<Client name>')
-        BRIDGEPW(oauth21)
+        BRIDGEPW('<Client password>')
 </pre>
 ----
 [[I2Rest_Client|Back to i2Rest Client]]

@@ Line 45: / Line 45: @@
 |[[I2Rest_Client_command#AUTHPW| AUTHPW]] || User/OAuth2 client/dev passwd
 |-
-|[[I2Rest_Client_command#AUTHURL| AUTHURL ]] ||OAuth2 authorization endpoint || vHTTP resource to be requested for an authorization code
+|[[I2Rest_Client_command#AUTHURL| AUTHURL ]] ||OAuth2 authorization endpoint || HTTP resource to be requested for an authorization code
 |-
 |[[I2Rest_Client_command#TOKENURL| TOKENURL]] ||Token endpoint ||HTTP resource to be requested for an access token

@@ Line 47: / Line 47: @@
 |[[I2Rest_Client_command#AUTHURL| AUTHURL ]] ||OAuth2 authorization endpoint || vHTTP resource to be requested for an authorization code
 |-
-|[[I2Rest_Client_command#TOKENURL| TOKENURL]] || v||HTTP resource to be requested for an access token
+|[[I2Rest_Client_command#TOKENURL| TOKENURL]] ||Token endpoint ||HTTP resource to be requested for an access token
 |-
-|[[I2Rest_Client_command#SCOPE| SCOPE]] || Scope ||The set of resources and operations that are allowed to application with access token
+|[[I2Rest_Client_command#SCOPE| SCOPE]] || Scope || The set of resources and operations that are allowed to application with access token
 |-
 |[[I2Rest_Client_command#BRIDGEURL| BRIDGEURL]]  || i2Rest access flow bridge url ||Redirection URI to be passed to authorization server

@@ Line 33: / Line 33: @@
 The next parameters are mandotary to perform request with Authorization code flow by I2Rest command.<br>
 {| class="wikitable"
-! Parameter!! Description
+! Keyword !! Parameter!! Description
 |-
-|[[I2Rest_Client_command#AUTHMETHOD | Authentication method]] || *BRIDGE must be specified
+|[[I2Rest_Client_command#AUTHMETHOD | AUTHMETHOD]] || Authentication method || *BRIDGE must be specified
 |-
-|[[I2Rest_Client_command#COMAND| Command]] || Any of available request type can be choosen
+|[[I2Rest_Client_command#COMAND| COMAND ]] || Request type || Any of available request type can be choosen
 |-
-|[[I2Rest_Client_command#URL| API endpoint]] || HTTP resource to serve the request
+|[[I2Rest_Client_command#URL| URL ]] || API endpoint || HTTP resource to serve the request
 |-
-|[[I2Rest_Client_command#AUTHID| User/OAuth2 client/device ID]] ||rowspan="2"|  Credentials to authenticate I2Rest Client with authorization server
+|[[I2Rest_Client_command#AUTHID| AUTHID]] || User/OAuth2 client/device ID ||rowspan="2"|  Credentials to authenticate I2Rest Client with authorization server
 |-
-|[[I2Rest_Client_command#AUTHPW| User/OAuth2 client/dev passwd]]
+|[[I2Rest_Client_command#AUTHPW| AUTHPW]] || User/OAuth2 client/dev passwd
 |-
-|[[I2Rest_Client_command#AUTHURL| OAuth2 authorization endpoint]] || HTTP resource to be requested for an authorization code
+|[[I2Rest_Client_command#AUTHURL| AUTHURL ]] ||OAuth2 authorization endpoint || vHTTP resource to be requested for an authorization code
 |-
-|[[I2Rest_Client_command#TOKENURL| OAuth2 token endpoint]] || HTTP resource to be requested for an access token
+|[[I2Rest_Client_command#TOKENURL| TOKENURL]] || v||HTTP resource to be requested for an access token
 |-
-|[[I2Rest_Client_command#SCOPE| Scope]] || The set of resources and operations that are allowed to application with access token
+|[[I2Rest_Client_command#SCOPE| SCOPE]] || Scope ||The set of resources and operations that are allowed to application with access token
 |-
-|[[I2Rest_Client_command#BRIDGEURL| i2Rest access flow bridge url]] || Redirection URI to be passed to authorization server
+|[[I2Rest_Client_command#BRIDGEURL| BRIDGEURL]]  || i2Rest access flow bridge url ||Redirection URI to be passed to authorization server
 |-
-|[[I2Rest_Client_command#BRIDGEID| i2Rest bridge client ID]] ||rowspan="2"|  Credentials to authenticate I2Rest Client with i2rest Server
+|[[I2Rest_Client_command#BRIDGEID| BRIDGEID]]|| i2Rest bridge client ID ||rowspan="2"|  Credentials to authenticate I2Rest Client with i2rest Server
 |-
-|[[I2Rest_Client_command#BRIDGEPW| i2Rest bridge client password]]
+|[[I2Rest_Client_command#BRIDGEPW| BRIDGEPW ]] ||i2Rest bridge client password
 |-
 |}

@@ Line 20: / Line 20: @@
 (E) i2Rest Client starts polling I2Rest Server bridge with Bridge code to determine whether the user has authorized the request.
-(F) The authorization server authenticates the resource owner and performs authorization dialog to determin either access was granted or denied.
+(F) The authorization server authenticates the resource owner and performs authorization dialog to determin either access will be granted or denied.
 (G) The authorization server redirects the user-agent to the i2Rest Server bridge using the redirection URI provided earlier in the request or during client registration. The redirection URI includes an authorization code. Bridge local state will be checked for matching the one included in the request on step D for preventing cross-site request forgery.