I want to connect to the Office 365 web service for my organisation, however when I browse to the web service address and log in, the page just returns blank.
Any clever people here who know what I am missing?
I'm using this format: "https://" + "Server name" + "/EWS/Exchange.amsx"
To get the right endpoint to talk to, you use the Discovery Service API. This will return the URL for your organization’s endpoint. The O365 endpoint can change (don’t use hardcoded URL’s in your code), by using the Discovery Service API you always have the right URL you need.
Common endpoint discovery tasks using the Discovery Service API
https://msdn.microsoft.com/en-us/office/office365/howto/discover-service-endpoints
Related
I am trying to set up Google Integration in my self-hosted Nextcloud instance. For this I need a Google Cloud API Web application OAUTH Client ID and Secret, along with the preset Authorized redirect URI from my Nextcloud instance. I can easily create the ID and Secret for the Web app. But, if I put the Authorized redirect URI in the Google Cloud OAUTH page, it tells me "Save failed: The request has been classified as abusive and was not allowed to proceed".
For context, the Domain provided is a Google Domain which I am using with a Cloudflare proxied DNS. Google verification TXT record have been added to Cloudflare. I am self-hosting the Nextcloud instance with a subdomain of this domain behind an Nginx Proxy Manager with a Cloudflare SSL certificate. To add, all of these are running as docker containers on Ubuntu. Additionally I have also verified the Redirect URI as Safe from: https://global.sitesafety.trendmicro.com/result.php
Even then, apart from that specific URI, I have tried URI of other services I am self-hosting as well as the parent domain. All of these are giving the same message from the GCP OAUTH screen.
Kindly help me out with this considering I am fairly a novice.
I'm new to the GCP Services, and I'm trying to make an API Gateway to proxy two services, one is run on an App Engine and the other is actually a PaaS.
Can I configure Cloud Endpoints to redirect to that PaaS, and how? and if now what service in GCP suits this case?
Edit:
An example of what I'm trying to do is if my domain is test.com then i'd like app.test.com to be redirected to my App Engine and ip.test.com would be directed for example to https://httpbin.org/ip.
I wrote an article on this for securing the endpoint. Set the value that you want in the x-google-backend.
I also provide some tips about the URL rewriting if you want.
EDIT 1
If you want to perform this routing
app.test.com -> App Engine
ip.test.com -> External service
You need to use a HTTPS Load Balancer and not API Gateway.
Then,
create a serverless NEG and configure it with App Engine
create an Internet NEG and configure it to reach your internet accessible PaaS service
Create a URL MAP with the correct routing
That's all (wait 3 - 5 minutes, the delay to dispatch your configuration around the globe.)
Yes, you can run an Extensible Service Proxy in front of your non-GCP backend service so that Cloud Endpoints can proxy requests to it.
Docs: https://cloud.google.com/endpoints/docs/openapi/running-esp-localdev
I have a backend service, which I don't want to be expose, and also, just the employees that uses Gsuite oAuth should access.
Instead of exposing the backend and add the logic of oauth in it, I looked at the vouch-proxy project, which fits me very well (a proxy that redirects unauthenticated traffic to oauth login page and then, when a valid token is passed, it's redirect to the backend.
Before using this vouch proxy, do GCP has something built-in for it? Or another kind of setup that my backend service is not exposed?
Google Cloud provides the Identity-Aware Proxy (IAP) that would precisely fit your needs since it's integrating well with G Suite domain and can sit in front of your Load-Balancer.
I have setup Cloud IAP on a development environment (spun up with Kubernetes and using Let's Encrypt) and everything is working fine.
The setup is pretty basic for this app:
1) An API that has a number of REST endpoints and a persistent data store, in project A
2) A SPA front end app that utilizes said API, in a different project B
In my browser (tried Chrome and Firefox), I can authenticate my Google user in both apps via the IAP screen (by going to each domain in a browser tab), but once I try to use the SPA and it attempts requests to the API, I see the network requests 302 redirect to the Google IAP sign-in page.
Question:
Is there a header or cookie that needs to be sent over via the API requests on behalf of the user so that IAP allows pass-thru?
Note
I see these two cookies btw GCP_IAAP_AUTH_TOKEN and GCP_IAAP_XSRF_NONCE.
What's protected with IAP, "API" or "SPA"? If it's SPA, IAP should work as normal. If it's API, your best option today is to use https://cloud.google.com/iap/docs/authentication-howto to have SPA authenticate to API, and maybe also have it pass down https://cloud.google.com/iap/docs/signed-headers-howto so that API can separately verify the end-user's credentials.
Passing down GCP_IAAP_AUTH_TOKEN from SPA to API won't work, we strip that before passing the request to the end-user application for security reasons (in case the transport between the load balancer and the application is HTTP, just to make life a little harder for an attacker.)
We are going to integrate Dynamics NAV 2013 with PHP eCommerce and are planning to do this by dynamics nav web services. I know that to integrate with PHP I have to enable NTLM authentication, but I'm wondering if is it possible to publish web service which doesn't require login/password authorization?
Second thing, if I want to allow only specified IP's to access my web service, is it possible to do this in Navision or it's server administrators problem?
The client consuming a Nav web service has to be authenticated and mapped to a system user account, but it is possible to authenticate via the user name and the corresponding web service access key instead of the domain password.
Common approach is to create a user account that is used for web service access only, generate the web service access key, and pass this dedicated user's credentials from the consuming application. Client application will be required to provide the security certificate.
Besides, it is a good idea to create a separate service instance specifically for external access (usually users connecting via WAN).
Create a new Nav server instance and set ClientServicesCredentialType" = "NavUserPassword". How to configure authentication via NavUserPassword
Create a user account with Web Service Access Key: Use an Access Key for SOAP and OData Web Service Authentication
Setup security certificate for the web service: Implementing Security Certificates
Develop your application that will consume Nav web service, and pass the Nav user name and the web service access key instead of the password from this application.
This way, all users connecting from your web application will be authenticated, but they won't have to enter user name / password and you don't risk exposing your domain account credentials.
As for your second question - there is no way to setup this restriction from inside Nav that I'm aware of. I think this is a task for sysadmins - firewall applications allow you to setup very elaborate access rules.
No you can't disable auth (you able to select auth type other than ntlm though). And I believe there is no case in witch you shoud do this with Nav. Nav stores financial information so no-no-no you should not do this under any corcumstances.
No you can't restrict acceess by IP via Nav.