How to setup ReadyAPI with OAuth 2.0 & access webPage For to retriew accesstoken

Hey harry 

 

OAuth is tricky or at least I've always found it confusing - it's a lot more difficult to setup than say basic auth cos it's not just a username and password.

 

There's essentially 3 or 4 different 'components'  in the OAuth process flow.  It goes something like the following:

 

1. Client app (component1) submits an 'authorisation request' to User Resource Owner (component2)

2.  User Resource Owner returns 'authorisation grant' if Client app used correct creds

3. Client app submits 'authorisation grant' from previous step to the Authorisation Server (component3)

4. Authorisation server returns an 'bearer/access token' to Client app

5. Client app submits 'bearer/access token' to Resource Server (component4) - this is the endpoint of the resource your trying to hit from the client app

6. Resource Server authorises request and returns a valid response to the Client app

 

I cant remember the difference between a bearer and access token - that's why i haven't been specific above - but there is a difference apparently - suffice it to say - it's a token value that gets used

 

Right - your question - the client id and client secret are details sent by the Authorisation Server (see 6 steps above) back to the Client app (at step4).  Client then uses these along with the bearer/access token in step5 to send to the Resource Server.

 

At least that's how I think it works - it's always been a little confusing to me - so someone might have a better explanation - but the above is the way I think about it when dealing with OAuth v1 or 2

 

 

So - in step5 equivalent of one of my OAuth v2 requests - the Client submits the following request (and payload) to my Resource Server:

 

POST https://login.microsoftonline.com/6f504113-6b64-43f2-ade9-242e0599999/oauth2/token HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 192
Host: login.microsoftonline.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.5 (Java/12.0.1)

resource=${#Project#resource}
&client_id=${#Project#client_id}
&client_secret=${#Project#client_secret}
&grant_type=${#Project#grant_type}

 

 

 

Hope this helps and wasn't too confusing!

 

Cheers,

 

rich