Is it possible to send encoded password in OAUTH2 password grant flow.
POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
grant_type=password&username=johndoe&password=<<Encoded Password>>
Any leads or documentation in wso2 ?
Any reason why you want the password to be encoded? As it's OAUTH2 so unless the generated token doesn't align with provided username and password the access will be denied.
Related
I'm trying to get the OAuth Token to get auth access to some of the FedEx APIs ( like Track API for tracking shipments ), but I get a
401 (NOT.AUTHORIZED.ERROR -> "The given client credentials were not valid. Please modify your request and try again") error.
(At the moment, I'm using Postman to try and test the APIs.)
Here is the url I'm using, found provided by FedEx:
https://apis-sandbox.fedex.com/oauth/token
I've followed ( to my understanding ) how the body and headers should be set:
Headers: Content-Type: application/x-www-form-urlencoded
Body: x-www-form-urlencoded (Postman option):
grant_type: client_crendentials
client_id: ***PROJECT_API_KEY
client_secret: ***PROJECT_SECRET KEY
After sending, I only get the error message above. I checked / doubled-checked my API keys, but I can't seem to get it to go through.
Any ideas?
postman settings:
POST - URL https://apis-sandbox.fedex.com/oauth/token
Headers - Content-Type: application/x-www-form-urlencoded
Body - x-www-form-urlencoded:
grant_type: client_credentials
client_id: *******
client_secret: *******
(information gotten from https://developer.fedex.com/api/en-us/catalog/authorization/v1/docs.html)
The sandbox API credentials are not immediately usable when creating a new account. It took >1 hour for me to get a registration complete email from FedEx after which the sandbox credentials became valid.
Hello i try do request get token from keycloak. I poison request with help postman.
I am sending the request in this form.
POST http://localhost:8484/auth/realms/realm-name/protocol/openid-connect/token
Headers:
Content-Type: application/x-www-form-urlencoded
Body x-www-form-urlencoded:
client_id: my-client
username: username
password: password
grant_type: password
client_secret: secret_client
In response i get this message. {"error":"invalid_grant","error_description":"Invalid user credentials"}
I always return this error, but username and password are correct.
What could this be related to? Can i see over details error description? And what didn't i do correct?
Here is the flow I am attempting in postman.
Get access token
{{server}}/auth/realms/{{realm}}/protocol/openid-connect/token
I get the access token. I then run the next query
{{server}}/auth/realms/{{realm}}/protocol/openid-connect/userinfo
I put these in the headers
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer {{access_token}}
I get a random string in return
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJnN0FHMmJXMmhmQzBLTHJ0S1NUV2V4eTBGWVhsYklybXVEdnF0aDF2MFpNIn0.eyJzdWIiOiIxOGI0OTJhMy0wOGFlLTQ2NjQtODBjNi1iZGQ5Nzk2ODdiMzQiLCJhdWQiOiJibGluZHNwb3QtYXV0aCIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9hdXRoL3JlYWxtcy9CbGluZHNwb3QifQ.UNyZ2AifgqK9NAiSVwWMFT4_EEleMBztodPHu19NrzIt0DUteK4gfYlgAf-Yfk6w3ue3TyjpD93HFlM-1AG2bHgIyIxI01IbEB2ew9b8xgLiexLrQkgQHIWWWFxSOqQCBo0VPgY3yi0ib3sqeBAcxpvfOhtvQuEH0lHdPFXh8DTJQL18Q3TAhTRpknpwIQ5mpjhaeIW2HXpExrPp6-35r2riPifS_nFNaTqPTSWAFHBiqFEa2_PnQcC6f09jGQYYGkjHnetuAdcmxmhskb59YYlqvRpvezi-Af9IHNhCDad0zomMJK5ajIYUcaXWpAuQZMhPp1OvTB79Olc-YUUOIg
to get the user infos you have to make a get Request using this endpoint:{{keycloak_url}}/auth/realms/{{realm}}/protocol/openid-connect/userinfo,
in Authorization : bearen token
Userinfo specification doesn't specify Content-Type: application/x-www-form-urlencoded header - see https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest
So use standard GET request {{server}}/auth/realms/{{realm}}/protocol/openid-connect/userinfo with Authorization: Bearer {{access_token}} header only.
To get userInfo as JSON response, make sure "User Info Signed Response Algorithm" is set to "unsigned" in your client settings in Keycloak.
I'm running a flask api and I want to write some tavern tests for it. I use a basic base64 encode for the username and password that I send in the header when making requests which works fine on the API but I can't seem to get it to work for tavern.
stages:
- name: login
request:
url: url
method: GET
headers:
Authorization: Basic aGVsbG9zdGFja292ZXJmbG93
accept: application/json
response:
My api keeps refusing the authorization and without the Basic tag it doesn't recognize the format. Here is the flask authorization logic:
try:
api_key = base64.b64decode(api_key)
username, password = api_key.split(':')
if password == users[username]:
user = User(username)
return user
except TypeError:
current_app.login_manager.unauthorized()
All help/suggestions are appreciated
There's documentation on this feature here: https://taverntesting.github.io/documentation#http-basic-auth
I am trying to integrate django-rest-auth package in my web application. So far i am able to register users, send password reset email and login using the API provided by django-rest-auth package.
Now when i send a login request, it returns "token" upon successful authentication.
How do i send authentication token in further requests? For example, i am trying to fetch user using GET /rest-auth/user but it is giving me a response Authentication credentials not provided. I have tried passing token via HTTP Basic Authentication (base64 encode token as username and leave password as empty). I am still not able to work.
Anyone knows how i am supposed to pass this token in requests?
If you want to use the Token Authentication you have to set the Authorization HTTP header. From the docs:
For clients to authenticate, the token key should be included in the Authorization HTTP header. The key should be prefixed by the string literal "Token", with whitespace separating the two strings. For example:
Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b
In an ajax call you can a header like this:
$.ajax({
type: 'POST',
url: url,
beforeSend: function (request)
{
request.setRequestHeader("Authorization", "Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b");
},
});
HI
You need to send token in headers
$.ajax({
type:"POST",
beforeSend: function (request)
{
request.setRequestHeader("Authority", 'Bearer 33a95862173cc0565fe502eb062b2e7c67e23a3a');
},
and in django code use
user = request.user
if user:
return "User token verified"
elif :
return "User token not verified"
in django automaticaly find token in headers and using token fetch user data.