Forum Discussion

harry's avatar
harry
Contributor
4 years ago
Solved

How to setup ReadyAPI with OAuth 2.0 & access webPage For to retriew accesstoken

  • Hey harry 

     

    OAuth is tricky or at least I've always found it confusing - it's a lot more difficult to setup than say basic auth cos it's not just a username and password.

     

    There's essentially 3 or 4 different 'components'  in the OAuth process flow.  It goes something like the following:

     

    1. Client app (component1) submits an 'authorisation request' to User Resource Owner (component2)

    2.  User Resource Owner returns 'authorisation grant' if Client app used correct creds

    3. Client app submits 'authorisation grant' from previous step to the Authorisation Server (component3)

    4. Authorisation server returns an 'bearer/access token' to Client app

    5. Client app submits 'bearer/access token' to Resource Server (component4) - this is the endpoint of the resource your trying to hit from the client app

    6. Resource Server authorises request and returns a valid response to the Client app

     

    I cant remember the difference between a bearer and access token - that's why i haven't been specific above - but there is a difference apparently - suffice it to say - it's a token value that gets used

     

    Right - your question - the client id and client secret are details sent by the Authorisation Server (see 6 steps above) back to the Client app (at step4).  Client then uses these along with the bearer/access token in step5 to send to the Resource Server.

     

    At least that's how I think it works - it's always been a little confusing to me - so someone might have a better explanation - but the above is the way I think about it when dealing with OAuth v1 or 2

     

     

    So - in step5 equivalent of one of my OAuth v2 requests - the Client submits the following request (and payload) to my Resource Server:

     

    POST https://login.microsoftonline.com/6f504113-6b64-43f2-ade9-242e0599999/oauth2/token HTTP/1.1
    Accept-Encoding: gzip,deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 192
    Host: login.microsoftonline.com
    Connection: Keep-Alive
    User-Agent: Apache-HttpClient/4.5.5 (Java/12.0.1)
    
    resource=${#Project#resource}
    &client_id=${#Project#client_id}
    &client_secret=${#Project#client_secret}
    &grant_type=${#Project#grant_type}

     

     

     

    Hope this helps and wasn't too confusing!

     

    Cheers,

     

    rich

2 Replies

  • richie's avatar
    richie
    Community Hero

    Hey harry 

     

    OAuth is tricky or at least I've always found it confusing - it's a lot more difficult to setup than say basic auth cos it's not just a username and password.

     

    There's essentially 3 or 4 different 'components'  in the OAuth process flow.  It goes something like the following:

     

    1. Client app (component1) submits an 'authorisation request' to User Resource Owner (component2)

    2.  User Resource Owner returns 'authorisation grant' if Client app used correct creds

    3. Client app submits 'authorisation grant' from previous step to the Authorisation Server (component3)

    4. Authorisation server returns an 'bearer/access token' to Client app

    5. Client app submits 'bearer/access token' to Resource Server (component4) - this is the endpoint of the resource your trying to hit from the client app

    6. Resource Server authorises request and returns a valid response to the Client app

     

    I cant remember the difference between a bearer and access token - that's why i haven't been specific above - but there is a difference apparently - suffice it to say - it's a token value that gets used

     

    Right - your question - the client id and client secret are details sent by the Authorisation Server (see 6 steps above) back to the Client app (at step4).  Client then uses these along with the bearer/access token in step5 to send to the Resource Server.

     

    At least that's how I think it works - it's always been a little confusing to me - so someone might have a better explanation - but the above is the way I think about it when dealing with OAuth v1 or 2

     

     

    So - in step5 equivalent of one of my OAuth v2 requests - the Client submits the following request (and payload) to my Resource Server:

     

    POST https://login.microsoftonline.com/6f504113-6b64-43f2-ade9-242e0599999/oauth2/token HTTP/1.1
    Accept-Encoding: gzip,deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 192
    Host: login.microsoftonline.com
    Connection: Keep-Alive
    User-Agent: Apache-HttpClient/4.5.5 (Java/12.0.1)
    
    resource=${#Project#resource}
    &client_id=${#Project#client_id}
    &client_secret=${#Project#client_secret}
    &grant_type=${#Project#grant_type}

     

     

     

    Hope this helps and wasn't too confusing!

     

    Cheers,

     

    rich

    • harry's avatar
      harry
      Contributor

      Sorry for late response. Thanks Richie. Dev team came up with API's that are form based. They are not Rest based API's.Can i know how to test form based API's using Ready API?