NoAuth usecase 4 - Revision history

Pavel.lobko at 07:01, 9 July 2020

2020-07-09T07:01:03Z

Pavel.lobko at 07:00, 9 July 2020

2020-07-09T07:00:25Z

Pavel.lobko at 09:55, 22 May 2020

2020-05-22T09:55:19Z

Pavel.lobko at 09:53, 22 May 2020

2020-05-22T09:53:22Z

Pavel.lobko: /* Initial step */

2020-05-22T09:47:21Z

‎Initial step

Pavel.lobko: /* Initial step */

2020-05-22T09:46:54Z

‎Initial step

Pavel.lobko: /* Initial step */

2020-05-22T09:46:02Z

‎Initial step

Pavel.lobko: /* Initial step */

2020-05-22T09:45:33Z

‎Initial step

Pavel.lobko: /* JSON Web Token */

2020-05-22T09:40:07Z

‎JSON Web Token

Pavel.lobko: /* Initial step */

2020-05-22T09:39:42Z

‎Initial step

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:Dealing with Google OAuth 2.0 for Server to Server Applications}}
 When you need your application to call Google APIs on behalf of its own (no user data is accessing and user is not involved directly), you should refer to [https://developers.google.com/identity/protocols/oauth2/service-account Google OAuth 2.0 for Server to Server Applications].
-It is not exactly [[Client_flow_description | Oauth2 Client Credential flow]], so i2Rest Client can't deal with it for you using existing built-in authentication flows.
+It is not exactly [[Client_flow_description | OAuth2 Client Credential flow]], so i2Rest Client can't deal with it for you using existing built-in authentication flows.
 But we still can reproduce this authorization scenario composing requests and handling responses manually.
 Lets take a look on steps we should perform. <br>

@@ Line 9: / Line 9: @@
 B) Request an access token from the Google OAuth 2.0 Authorization Server.<br>
 C) Handle Authorization Server JSON response.<br>
-D) Use token in api call<br>
+D) Use token to perform API call<br>
 == Initial step ==

@@ Line 6: / Line 6: @@
 [[File:Google-serv-to-serv.png|400px]]<br>
-A)Create a JSON Web Token (JWT, pronounced, "jot") which includes a header, a claim set, and a signature.<br>
+A) Create a JSON Web Token (JWT, pronounced, "jot") which includes a header, a claim set, and a signature.<br>
-B)Request an access token from the Google OAuth 2.0 Authorization Server.<br>
+B) Request an access token from the Google OAuth 2.0 Authorization Server.<br>
-C)Handle Authorization Server JSON response.<br>
+C) Handle Authorization Server JSON response.<br>
-D)Use token in api call<br>
+D) Use token in api call<br>
 == Initial step ==

@@ Line 22: / Line 22: @@
 The next step is POST request on https://oauth2.googleapis.com/token with JWT as an URL encoded request body.<br>
 <small>'''Note:''' you have to [[Add_external_CA_to_trust_list  |add Google.com SSL certificate CA to your DCM]] to perform https requests </small>
     I2REST COMMAND(*POST)
         URL('https://oauth2.googleapis.com/token')
@@ Line 45: / Line 46: @@
         SENTLOG('/home/btpl/sejwt.log')
         AUTHMETHOD(*NONE)
+</pre>
 == Handling Authorization Server response ==
 If we composed JWT and access token request correctly, Authorization Server will respond with an access token.
      Server response (status 200, shown 261 bytes of 261):
      {"access_token":"ya29.c.Ko8BxwcD_TDznwIQVB7Y_vs1S8a86_DhMfVwz1rcMfLkaMkMtx
@@ Line 53: / Line 55: @@
      DfSrfVL0CSk1j_BgEdR0jkPCCsRQPtWkSdSm-cH2vFZZiVcOOEOq4Yt8C3jzBl3kzNt2N882ic
      P0G6vmwdFljOdhY","expires_in":3599,"token_type":"Bearer"}
+</pre>
 == Authorized API call ==
 Now it's time to call an API. As an example we will create Google service account with [https://cloud.google.com/iam/docs/reference/rest IAM API] and appropriate  [https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/create method]. Access token will be attached using the '''access_token''' query string parameter.
+<pre>
     I2REST COMMAND(*POST)
         URL('https://iam.googleapis.com/v1/projects/client-fl
@@ Line 74: / Line 76: @@
         SENTLOG('/home/btpl/sncreatsr1.log')
         AUTHMETHOD(*NONE)
+</pre>
 Let's check if account was created with another request to [https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/list list method] of the same API. At this time we will attach access token as an additional header, which is a preferred option.
+<pre>
    I2REST COMMAND(*GET)
         URL('https://iam.googleapis.com/v1/projects/client-fl
@@ Line 91: / Line 93: @@
         SENTLOG('/home/btpl/CAdrivesent.log')
         AUTHMETHOD(*NONE)
+</pre>
 And here is server respond showing us that both requests were successfull:
+<pre>
    "accounts": [
+     {
@@ Line 116: / Line 118: @@
+     }
+     ]

@@ Line 12: / Line 12: @@
 == Initial step ==
-To perform server-to-(Google)server interactions you need [[https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount a service account]], which is an account that belongs to your application instead of to an individual end user. Your application will call Google APIs on behalf of the service account using service account credentials - a generated email address that is unique and at least one public/private key pair. We should go to [[https://console.developers.google.com/ Google API console]] and find this account details, because they are necessary at the next step.
+To perform server-to-(Google)server interactions you need [https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount a service account], which is an account that belongs to your application instead of to an individual end user. Your application will call Google APIs on behalf of the service account using service account credentials - a generated email address that is unique and at least one public/private key pair. We should go to [https://console.developers.google.com/ Google API console] and find this account details, because they are necessary at the next step.
 == JSON Web Token ==

@@ Line 15: / Line 15: @@
 == JSON Web Token ==
-At first we have to deal with JSON Web Token (JWT). JWT consists of two JSON objects - a header and a claim set, and a signature. All parts must be encoded using the Base64url encoding. Using JWT encoders [https://jwt.io like this one] can save much time.
+Now we have to deal with JSON Web Token (JWT). JWT consists of two JSON objects - a header and a claim set, and a signature. All parts must be encoded using the Base64url encoding. Using JWT encoders [https://jwt.io like this one] can save much time.
 So lets compose our JWT using credentials prepared on the initial step and [https://developers.google.com/identity/protocols/oauth2/service-account#creatingjwt Google's instructions].<br>
 [[File:Noauth3-JWTIO.png|600px]]