Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

OAuth2 - Authorize with no user interaction

So I'm trying to access my own data from an external app via their API. I only need access to my own data. Not trying to receive data from any of my users' accounts, so they don't need to authorize anything. So obviously I need to avoid any redirects (which seems to be the standard process the more I research OAuth...)

The process is hit the /authorize endpoint, which returns a code. Then provide that code in a request to the accesstoken endpoint. Which then allows me to access my account via the API. I'm 95% sure this process is standard for all OAuth, but figured I'd provide details in case it's not.

How do I provide credentials on the back end to get a code to enter into the request for a token, so that all user interaction is negated? The API I'm using forces me to use OAuth.

like image 524
Doug Avatar asked Jun 02 '17 22:06

Doug


People also ask

Is OAuth 2.0 authentication or authorization?

OAuth 2.0 is an authorization protocol and NOT an authentication protocol. As such, it is designed primarily as a means of granting access to a set of resources, for example, remote APIs or user's data. OAuth 2.0 uses Access Tokens.

How does OAuth 2.0 authorization work?

How Does OAuth 2.0 Work? At the most basic level, before OAuth 2.0 can be used, the Client must acquire its own credentials, a _client id _ and client secret, from the Authorization Server in order to identify and authenticate itself when requesting an Access Token.


2 Answers

The oauth2 grant you are describing is called Authorization Code Grant. This way of authentication has been designed so that applications which want to access resources of a user do not have access to the users credentials.

So if you found a way to interact with the user credentials in this grant it would be considered a hack.

If you do not want the individual user to enter the username and password but you want to access the api with a kind of "system account" this is not the oauth grant you should use.

There are multiple grants that would work for you. The question is which are supported by the authorization server and available to you.

Resource Owner Password Credentials Grant

This grant type is suitable for clients capable of obtaining the resource owner's credentials.

However

The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application.

It is very likely that this grant type is not avaiable as it could be misused to steal user credentials.

Client credential grant

The client can request an access token using only its client credentials.

How the resources are tied to a client is not part of the oauth specification and therefore provider specific.


If you want to read more about oauth2 here is a good article.

like image 52
NtFreX Avatar answered Sep 22 '22 00:09

NtFreX


The Oauth 2 grant flow that you're describing is the Authorization Code Grant Flow, like the above answer says. And like they say, if you have the option of using one of the above two grants with that API, that's the easiest solution.

However, if you don't, there's still a way to avoid "user interaction". It's unclear what you mean by "user interaction", but in the Authorization Code flow, that usually means logging into a web app that calls the API you are trying to authenticate into, and then consenting on the consent page. See https://dev.fitbit.com/docs/oauth2/#authorization-page for an example (I implemented OAuth 2 for Fitbit :)). You'll need to use an automated web browser like Selenium to click the consent button. Then you can capture the code in the response from /authorize and send the code to the accesstoken endpoint.

like image 44
skeller88 Avatar answered Sep 24 '22 00:09

skeller88