Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
docs:2500_config_apps:setting_up_oauth_protection [2026/07/07 08:00] – aware_admindocs:2500_config_apps:setting_up_oauth_protection [2026/07/07 08:55] (current) – aware_admin
Line 31: Line 31:
 <code>http://ServerName:ServerPort/CXF/services/serviceCall/api?serviceParameters</code> <code>http://ServerName:ServerPort/CXF/services/serviceCall/api?serviceParameters</code>
   - The following HTTP headers must be provided with the call:   - The following HTTP headers must be provided with the call:
-    - Authorization=[Bearer accessToken] +    - <code>Authorization=[Bearer accessToken]</code> 
-    - AW_DOMAIN=Name of business space +    - <code>AW_DOMAIN=Name of business space</code> 
-    - AW_SERVICE=Name of Aware IM service+    - <code>AW_SERVICE=Name of Aware IM service</code>
  
-REFRESH TOKENS:+==== Refresh Tokens ====
 Refresh tokens are returned along with access token in a JSON string as part of the access token request: Refresh tokens are returned along with access token in a JSON string as part of the access token request:
-{"tokenKey":"...","tokenType:"Bearer","refreshToken":...,"expiresIn":3600,"issuedAt":-1,"issuer":null,"encedToken":null,"parameters": +<code>{"tokenKey":"...","tokenType:"Bearer","refreshToken":...,"expiresIn":3600,"issuedAt":-1,"issuer":null,"encedToken":null,"parameters": </code> 
-A refresh token can then be exchanged for a new access token once the original access token expires with the following call (refresh token is specified in the refresh_token parameter): +A refresh token can then be exchanged for a new access token once the original access token expires with the following call (refresh token is specified in the "refresh_token" parameter 
-http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=refresh_token&refresh_token=...&client_id=...&client_secret=...&redirect_uri=... +<code>http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=refresh_token&refresh_token=...&client_id=...&client_secret=...&redirect_uri=...</code>
-Same reply as for the access token request should be received with the new access token and new refresh token.+
  
-SCOPES: +The same reply as for the access token request should be received with the new access token and new refresh token. 
-1. Client must specify scope(s) in the authorization request. Requested scopes are separated by a space symbol (&scope=scope1%20scope2) + 
-2. All requested scopes must be registered for the client. If no scopes are requested in the call, registered scopes are used. +==== Scopes ==== 
-3. The category of the called service must match one the approved scopes (approved by the end user) +  - Clients must specify scope(s) in the authorization request. Requested scopes are separated by a space symbol (&scope=scope1%20scope2) 
-4. Example of a valid service category: +  - All requested scopes must be registered for the client. If no scopes are requested in the call, registered scopes are used. 
 +  - The category of the called service must match one the approved scopes (approved by the end user) 
 +  - Example of a valid service category: 
 BSPrefix_scope1_scope2_scope3  BSPrefix_scope1_scope2_scope3 
 (provided that scope3 is not "general") (provided that scope3 is not "general")
  
-CLIENT CREDENTIALS FLOW: +==== Client Credentials Flow ==== 
-The above describes “authorization” work flow. To use “client credentials workflow do the following: + 
-In this flow you just need to call the AccessTokenService with a particular grant type. So you don't need to call the authorization service as the first step. +The instructions above are for the “authorization” workflow. To use “client credentials workflow" do the following: 
-The first step should be calling AccessTokenService but instead of the authorization_code grant type you specify client_credentials grant type:+  - In this flow the client just needs to call the AccessTokenService with a particular grant type. The client does not need to call the authorization service as the first step. 
 +  - The first step should be calling AccessTokenService but instead of the authorization_code grant type you specify client_credentials grant type:
 instead of this: instead of this:
-http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=authorization_code&code=...&client_id=...&client_secret=...&redirect_uri=... +<code>http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=authorization_code&code=...&client_id=...&client_secret=...&redirect_uri=...</code> 
-You specify this: +the client ashould call this: 
-http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=client_credentials&client_id=...&client_secret=... +<code>http://ServerName:ServerPort/CXF/services/oauth/token?grant_type=client_credentials&client_id=...&client_secret=...</code>
- +
-For this to work a special ClientCredentialsGrantHandler needs to be registered. Again in theory this can be done by modifying the file AwareIM/Tomcat/webapps/CXF/WEB-INF/awareim.xml. You need to add the following: +
-     <bean id="clientCredentialsGrantHandler" class="com.awaresoft.oauthcxf.services.AwareIMCCGrantHandler"> +
-         <property name="dataProvider" ref="oauthProvider"/> +
-     </bean> +
- +
-And then modify the following lines to add reference to the bean above (line in bold below): +
-     <bean id="accessTokenService" class="com.awaresoft.oauthcxf.services.AwareIMAccessTokenService"> +
-         <property name="dataProvider" ref="oauthProvider"/> +
-         <property name="grantHandlers"> +
-            <list> +
-             <ref bean="refreshGrantHandler"/> +
-             <ref bean=" clientCredentialsGrantHandler  "/> +
-            </list> +
-         </property> +
-     </bean> +
- +
-The rest is the same as for the Authorization flow. So the client registers as before and gets the client id and secret. Then he calls access token service as explained above with the same headers as for the Authorization flow. He will then get the access token in the same way as in the authorization flow (there is no refresh token!) +
-Then the client can call an Aware IM service using this access token in the same way it is done in the Authorization flow. +
  
 +==== Summary ====
  
 Your service documentation needs to convey to the callers of the service that before calling the service, they need to do the following: Your service documentation needs to convey to the callers of the service that before calling the service, they need to do the following: