SlideShare a Scribd company logo
1 of 35
ZERO to HERO
 The LinkedIn OAuth Dance
Using the LinkedIn API is easy...




                                    If you’re lord of the dance.
The OAuth Dance
OAuth is an open authorization standard for
APIs that does away with logins and passwords
to grant authorization to a third-party.

Some familiarity with OAuth is assumed, going
forward.

http://oauth.net/core/1.0a
Will any old OAuth library work with LinkedIn?


LinkedIn uses OAuth 1.0a and requires
HTTP Header-based Authorization.

Some OAuth libraries don’t yet support
OAuth 1.0a, or are built with lenient
OAuth implementations in mind.

LinkedIn’s OAuth is strict.Your library
might not be up to snuff.
You might have to get your hands dirty.
Quick Glossary That Won’t Be So Quick
            Because This Stuff Actually Takes Time to Learn
oauth_callback - This is either a URL or “oob” and denotes where to direct a user on your server following the “authorize”
step.

out of band - A form of OAuth where no URL callback is used and an oauth_verifier challenge is presented instead

requestToken - a token issued to you as a result of asking for it. Re-used in the authorize step

accessToken - a token issued to you at the end of the cycle. Represents a LinkedIn member and authorizes you to access
resources on their behalf

authorize - After getting a request token, you send the user to a signed authorize URL where they grant access to your
application

token secret - a string returned on the requestToken and accessToken steps, used in conjunction with your consumer secret
when signing certain requests.

consumer key - Your API key.

consumer secret - Your API secret. Used in the signing of all requests.

oauth_nonce - A random string, unique in every request.

oauth_timestamp - Epoch time in seconds, synced within 5 minutes of LinkedIn’s clock

oauth_token - Specified in many contexts, either the request token or access token.

oauth_verifier - A returned to you when your oauth_callback is invoked, or hand-entered by a user in the out-of-band flow.
All OAuth-based requests are very similar.You’re identifying a
 resource that you want to make a request to, you’re building a
 string that describes the request and your credentials for making
 it, and then you’re signing that string using a set of secrets.
 It’s like addressing an envelope where the address and stamp not
 only describe the destination but also the contents.


The OAuth 1.0a Request Cycle
1) You ask for a request token and specify your callback
2) You direct the user to our authorization screen
3) You either receive a callback at a URL you specified, or the
   member enters a PIN code (out-of-band authentication)
4) You ask for an access token
5) You make API calls!




The OAuth 1.0a Request Cycle
Building a requestToken request requires the following:
    HTTP Method, Request URI, oauth_callback, oauth_consumer_key,
    oauth_nonce, oauth_signature_method, oauth_timestamp, and
    oauth_version.



Getting a Request Token
First build your string to sign.

                                 We’ll use these values for this example.



    HTTP Method          POST


     Request URI         https://api.linkedin.com/uas/oauth/requestToken


    oauth_callback       http://linkedin.realitytechnicians.com:3000/oauth_consumers/taylor_singletary/callback


 oauth_consumer_key      dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV


     oauth_nonce         24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs8u0tk


oauth_signature_method   HMAC-SHA1


   oauth_timestamp       1260811626


    oauth_version        1.0




Getting a Request Token
First build your string to sign.

These parameters get sorted alphabetically, each value is URL escaped, and than
concatenated into a single string.

POST&https%3A%2F%2Fapi.linkedin.com%2Fuas%2Foauth
%2FrequestToken&oauth_callback%3Dhttp%253A%252F
%252Flinkedin.realitytechnicians.com
%253A3000%252Foauth_consumers
%252Ftaylor_singletary%252Fcallback
%26oauth_consumer_key%3DdTgSkaRKZjEnS1vAUu6e7-
aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV
%26oauth_nonce
%3D24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs8u0tk
%26oauth_signature_method%3DHMAC-
SHA1%26oauth_timestamp
%3D1260811626%26oauth_version%3D1.0


Getting a Request Token
Create your Authorization HTTP Header & Issue the Request

Now we sign this string using our consumer secret and create an HTTP Authorization header,.
The signature should be placed in the oauth_signature value.


Authorization: OAuth
oauth_nonce="24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs
8u0tk", oauth_callback="http%3A%2F
%2Flinkedin.realitytechnicians.com
%3A3000%2Foauth_consumers%2Ftaylor_singletary
%2Fcallback", oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1260811626",
oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7-
aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV",
oauth_signature="Ws%2B%2FH%2FonYnsZXyZwyEhgL
%2Bboq8s%3D", oauth_version="1.0"


Getting a Request Token
Evaluate the requestToken response

Now we issue this request to the requestToken endpoint, and if all is successful, you’ll get
something like the following URL encoded response:

 oauth_token=f7868c3a-7336-4662-
 a6d1-3219fb4650d1&oauth_token_secret=45e0ccd0-0c5
 d-431e-831a-63f10552338a&oauth_callback_confirmed
 =true


The oauth_token field is now your request token, and the oauth_token_secret will be used for
signing your request for an access token. oauth_callback_confirmed just gives you confirmation
that we recognized your oauth_callback parameter.

You’ll want to “hold on” to the oauth_token and oauth_token_secret until you’ve completed
the access token step.




Getting a Request Token
Build your authorization URL
Now that we have a request token, we can build the URL to authorize the user. We’ll then
redirect the user to this URL so they can grant your application access.

An authorization URL is simply this end point: https://api.linkedin.com/uas/oauth/authorize with
a query parameter tacked on called oauth_token. The value for this parameter is equal to the
request token you received in the previous step.

With this same example, you’d direct the user to this URL:


 https://api.linkedin.com/uas/oauth/authorize?
 oauth_token=f7868c3a-7336-4662-a6d1-3219fb4650d1


The user needs to land on this page within 5 minutes of your request token cycle. You should
not pass an oauth_callback parameter to this page (you already did that in the request token
step).




Authorizing the member
Send the user to LinkedIn’s Authorization Page
 The user will then be sent to our authorization page. When completed the user will either be
 sent back to your oauth_callback URL or presented with a series of digits they’ll be instructed
 to hand-enter into your application (if you are performing out-of-band authentication).




Authorizing the member
OAuth Callback vs. Out of Band


After authorizing your application, the     After authorizing your application, the
user will be sent to the URL you specified   member is presented with a PIN code.
as the oauth_callback.

Your callback will receive                                  In your application, you
an oauth_token and                                          should now present a UI
oauth_token_secret; these                                   allowing the user to
are the same as your                                        hand-enter the PIN
request tokens.                                             code.

You’ll also receive an                                      After receiving the PIN
oauth_verifier parameter,                                    code, you’ll be using it
which you will need to                                      for the accessToken step
attach as part of your                                      as the oauth_verifier.
accessToken request in the
next step.
Exchanging a request token for an access token.
Prepare your signing secret
Regardless of whether you used out-of-band authentication or not, you’ll now be equipped with
a request token, an oauth_token_secret, and an oauth_verifier. You’re now going to exchange
that request token for an access token, imbued with the permission of the LinkedIn member to
act on their behalf.

In LinkedIn’s strict OAuth implementation, a request for an access token must be signed using
both your consumer secret and the oauth_token_secret you received as when retrieving your
request token. Many existing OAuth libraries do not properly incorporate the
oauth_token_secret in this step.

Your signing key will be in the format of:
 url_escape(consumer_secret)&url_escape(oauth_token_secret)




Getting an Access Token
Now build your string to sign.




   We’ll use these values for this example. Your oauth_token is your requestToken.

    HTTP Method          POST

     Request URI         https://api.linkedin.com/uas/oauth/accessToken

 oauth_consumer_key      dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV

     oauth_nonce         WqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3UI

oauth_signature_method   HMAC-SHA1

   oauth_timestamp       1260811635

     oauth_token         f7868c3a-7336-4662-a6d1-3219fb4650d1

    oauth_verifier        75553

    oauth_version        1.0




Getting an Access Token
Now build your string to sign.

These parameters get sorted alphabetically, each value is URL escaped, and than
concatenated into a single string.



POST&https%3A%2F%2Fapi.linkedin.com%2Fuas%2Foauth
%2FaccessToken&oauth_consumer_key
%3DdTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-
klzBC1a4TKCnSgClWV%26oauth_nonce
%3DWqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3UI
%26oauth_signature_method%3DHMAC-
SHA1%26oauth_timestamp%3D1260811635%26oauth_token
%3Df7868c3a-7336-4662-
a6d1-3219fb4650d1%26oauth_verifier
%3D75553%26oauth_version%3D1.0




Getting an Access Token
Create your Authorization HTTP Header & Issue the Request
Now we sign this string using the secret we constructed from our consumer secret and
oauth_token_secret, then create an HTTP Authorization header, including the signature as the
oauth_signature value, and oauth_nonce, oauth_callback, oauth_signature_method,
oauth_timestamp, oauth_consumer_key, oauth_token, oauth_verifier, and oauth_version.



Authorization: OAuth
oauth_nonce="WqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3
UI", oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1260811635",
oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7-
aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV",
oauth_token="f7868c3a-7336-4662-a6d1-3219fb4650d1",
oauth_verifier="75553",
oauth_signature="gp3C1jCOgRyN106UIe0FLTzOmu8%3D",
oauth_version="1.0"




Getting an Access Token
Evaluate the accessToken response

Now we issue this request to the accessToken endpoint, and if all is successful, you’ll get
something like the following URL encoded response:


 oauth_token=fb74aed1-
 eb7d-4f3f-855c-137000243df8&oauth_token_secret=4e7f56
 2d-04b1-4488-8162-95a2454ae9a8


The oauth_token field is now your access token, and the oauth_token_secret will be used for
signing all requests on behalf of the member.

You’ll want to “hold on” to the oauth_token and oauth_token_secret for as long as you want to
act on the member’s behalf.

A LinkedIn member may specify that an access token is valid only for a certain period of time
(or forever), but can revoke access on LinkedIn.com at any time.




Getting an Access Token
You’ve acquired an access token!




But don’t hang up your dancing shoes yet.
LinkedIn is about people.
  LinkedIn is about you.
Making API resource requests is very similar to other operations. You’ll need your access
token, oauth_token_secret, and your API keys to continue.

We’re going to ask for our own profile from LinkedIn’s people resource. In LinkedIn resource
URLs, the tilde (“~”) character represents the member associated with your access token.
LinkedIn’s API works best when you explicitly tell it what you are looking for, so we’re asking for
the member’s id, first name, last name, and their headline only.

The resource URL for this request would be:




When URL encoding this resource in the following OAuth signing steps, you’ll want to ensure
that the tilde character does not become escaped. The field selectors are not query
parameters, but part of the path of the URI itself.



Requesting your own profile
Start by building your string to sign.




   We’ll use these values for this example. Your oauth_token is your access token.

    HTTP Method          GET


     Request URI         https://api.linkedin.com/v1/people/~:(id,first-name,last-name,headline)


 oauth_consumer_key      dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV


     oauth_nonce         Tv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0XhmY


oauth_signature_method   HMAC-SHA1


   oauth_timestamp       1260915816


     oauth_token         fb74aed1-eb7d-4f3f-855c-137000243df8


    oauth_version        1.0




Requesting your own profile
Start by building your signature base string.

These parameters get sorted alphabetically, each value is URL escaped, and than
concatenated into a single string.

 GET&https%3A%2F%2Fapi.linkedin.com%2Fv1%2Fpeople%2F~
 %3A%28id%2Cfirst-name%2Clast-name%2Cheadline
 %29&oauth_consumer_key%3DdTgSkaRKZjEnS1vAUu6e7-
 aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV
 %26oauth_nonce
 %3DTv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0XhmY
 %26oauth_signature_method%3DHMAC-
 SHA1%26oauth_timestamp%3D1260915816%26oauth_token
 %3Dfb74aed1-
 eb7d-4f3f-855c-137000243df8%26oauth_version%3D1.0




Requesting your own profile
Create your Authorization HTTP Header & Issue the Request
Now we sign this string using our consumer secret in conjunction with your access token’s
oauth_token_secret (just like in our previous steps) and create an HTTP Authorization header,.
The signature should be included as the oauth_signature value.




Authorization: OAuth
oauth_nonce="Tv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0Xh
mY", oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1260915816",
oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7-
aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV",
oauth_token="fb74aed1-eb7d-4f3f-855c-137000243df8",
oauth_signature="4imDw81fRdCI%2FBBoo0vwix5giVo%3D",
oauth_version="1.0"




Requesting your own profile
Evaluate the XML response

Now we issue this request to the people resource, and if all is successful, you’ll get something
like the following XML response, with your own profile values in place of my own.



 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <person>
   <id>esIpa2xh0v</id>
   <first-name>Taylor</first-name>
   <last-name>Singletary</last-name>
   <headline>Technical Evangelist at LinkedIn</headline>
 </person>



If the access token is invalid, or your signature was not properly calculated, you will receive a
401 Unauthorized error. There is always interesting debugging information in the XML body of
a failed request and the HTTP headers we return to you. Maybe your timestamp was off by a
few minutes? Maybe your signature was invalid? Maybe the access token is no longer valid?


Requesting your own profile
Troubleshooting
OAuth is complicated, and there are a number of things that go wrong.
Here are some tips.
Every error response we send you will contain an XML body describing the error, including a
timestamp representing API server time. Some OAuth-based requests will also return an
oauth_problem HTTP header.

Make sure that your server’s system clock is in sync with ours.

oauth_callback should only be provided on the requestToken step.

oauth_verifier is required in the accessToken step.

PUT & POST operations typically have XML Content-Types. Your OAuth library should
exclude the request body in signature calculations as a result.

For the access token step, remember that the request token’s oauth_token_secret must be
used as part of your signing key.

Likewise, for API resource requests, your access token’s oauth_token_secret must be used as
part of your signing key.

At this time, LinkedIn only supports HTTP header-based OAuth. Make sure that you are
passing your OAuth credentials as an Authorization HTTP header, not as query parameters
attached to the request.
Troubleshooting
Working with LinkedIn’s OAuth
OAuth Authentication
Common Issues with OAuth Authentication

General OAuth
OAuth 1.0a Spec
Beginner’s Guide to OAuth

Client Libraries
& Community Code
Ruby
PHP
Java
.NET




Further Reading
I hope you had the time of your life mastering the OAuth dance.
Thanks to all the great people in the LinkedIn Developer Community!

More Related Content

What's hot

Oauth2 and OWSM OAuth2 support
Oauth2 and OWSM OAuth2 supportOauth2 and OWSM OAuth2 support
Oauth2 and OWSM OAuth2 support
Gaurav Sharma
 

What's hot (20)

OAuth 2.0 - The fundamentals, the good , the bad, technical primer and commo...
OAuth 2.0  - The fundamentals, the good , the bad, technical primer and commo...OAuth 2.0  - The fundamentals, the good , the bad, technical primer and commo...
OAuth 2.0 - The fundamentals, the good , the bad, technical primer and commo...
 
The Many Flavors of OAuth - Understand Everything About OAuth2
The Many Flavors of OAuth - Understand Everything About OAuth2The Many Flavors of OAuth - Understand Everything About OAuth2
The Many Flavors of OAuth - Understand Everything About OAuth2
 
Intro to API Security with Oauth 2.0
Intro to API Security with Oauth 2.0Intro to API Security with Oauth 2.0
Intro to API Security with Oauth 2.0
 
The State of OAuth2
The State of OAuth2The State of OAuth2
The State of OAuth2
 
OAuth2 Authentication
OAuth2 AuthenticationOAuth2 Authentication
OAuth2 Authentication
 
OAuth 2 Presentation
OAuth 2 PresentationOAuth 2 Presentation
OAuth 2 Presentation
 
OAuth2 - Introduction
OAuth2 - IntroductionOAuth2 - Introduction
OAuth2 - Introduction
 
Oauth 2.0
Oauth 2.0Oauth 2.0
Oauth 2.0
 
OAuth - Open API Authentication
OAuth - Open API AuthenticationOAuth - Open API Authentication
OAuth - Open API Authentication
 
OAuth in the new .NET world (OWIN)
OAuth in the new .NET world (OWIN)OAuth in the new .NET world (OWIN)
OAuth in the new .NET world (OWIN)
 
Oauth2 and OWSM OAuth2 support
Oauth2 and OWSM OAuth2 supportOauth2 and OWSM OAuth2 support
Oauth2 and OWSM OAuth2 support
 
Implementing OAuth
Implementing OAuthImplementing OAuth
Implementing OAuth
 
An Introduction to OAuth2
An Introduction to OAuth2An Introduction to OAuth2
An Introduction to OAuth2
 
Oauth2.0
Oauth2.0Oauth2.0
Oauth2.0
 
Securing RESTful APIs using OAuth 2 and OpenID Connect
Securing RESTful APIs using OAuth 2 and OpenID ConnectSecuring RESTful APIs using OAuth 2 and OpenID Connect
Securing RESTful APIs using OAuth 2 and OpenID Connect
 
Stateless Auth using OAuth2 & JWT
Stateless Auth using OAuth2 & JWTStateless Auth using OAuth2 & JWT
Stateless Auth using OAuth2 & JWT
 
OAuth2 and Spring Security
OAuth2 and Spring SecurityOAuth2 and Spring Security
OAuth2 and Spring Security
 
OAuth big picture
OAuth big pictureOAuth big picture
OAuth big picture
 
OAuth2 + API Security
OAuth2 + API SecurityOAuth2 + API Security
OAuth2 + API Security
 
UC2013 Speed Geeking: Intro to OAuth2
UC2013 Speed Geeking: Intro to OAuth2UC2013 Speed Geeking: Intro to OAuth2
UC2013 Speed Geeking: Intro to OAuth2
 

Viewers also liked

Session 13 - Working with navigation and tab bar
Session 13 - Working with navigation and tab barSession 13 - Working with navigation and tab bar
Session 13 - Working with navigation and tab bar
Vu Tran Lam
 
How LinkedIn changed its security model in order to offer an API
How LinkedIn changed its security model  in order to offer an APIHow LinkedIn changed its security model  in order to offer an API
How LinkedIn changed its security model in order to offer an API
LinkedIn
 

Viewers also liked (13)

Linkedin Profile_V2 (1)
Linkedin Profile_V2 (1)Linkedin Profile_V2 (1)
Linkedin Profile_V2 (1)
 
OAuth 1.0
OAuth 1.0OAuth 1.0
OAuth 1.0
 
Session 13 - Working with navigation and tab bar
Session 13 - Working with navigation and tab barSession 13 - Working with navigation and tab bar
Session 13 - Working with navigation and tab bar
 
Everything You (N)ever Wanted to Know about Testing View Controllers
Everything You (N)ever Wanted to Know about Testing View ControllersEverything You (N)ever Wanted to Know about Testing View Controllers
Everything You (N)ever Wanted to Know about Testing View Controllers
 
Practical Core Bluetooth in IoT & Wearable projects @ AltConf 2016
Practical Core Bluetooth in IoT & Wearable projects @ AltConf 2016Practical Core Bluetooth in IoT & Wearable projects @ AltConf 2016
Practical Core Bluetooth in IoT & Wearable projects @ AltConf 2016
 
Engineering the New LinkedIn Profile
Engineering the New LinkedIn ProfileEngineering the New LinkedIn Profile
Engineering the New LinkedIn Profile
 
LinkedIn API Possibilities
LinkedIn API PossibilitiesLinkedIn API Possibilities
LinkedIn API Possibilities
 
Design First API's with RAML and SoapUI
Design First API's with RAML and SoapUIDesign First API's with RAML and SoapUI
Design First API's with RAML and SoapUI
 
Slideshare Doc
Slideshare DocSlideshare Doc
Slideshare Doc
 
API提供におけるOAuthの役割 #apijp
API提供におけるOAuthの役割 #apijpAPI提供におけるOAuthの役割 #apijp
API提供におけるOAuthの役割 #apijp
 
Importing Data into Neo4j quickly and easily - StackOverflow
Importing Data into Neo4j quickly and easily - StackOverflowImporting Data into Neo4j quickly and easily - StackOverflow
Importing Data into Neo4j quickly and easily - StackOverflow
 
Client-Side Deep Learning
Client-Side Deep LearningClient-Side Deep Learning
Client-Side Deep Learning
 
How LinkedIn changed its security model in order to offer an API
How LinkedIn changed its security model  in order to offer an APIHow LinkedIn changed its security model  in order to offer an API
How LinkedIn changed its security model in order to offer an API
 

Similar to LinkedIn OAuth: Zero To Hero

Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02
Mohan Kumar Tadikimalla
 
Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02
Mohan Kumar Tadikimalla
 
Authorization with oAuth
Authorization with oAuthAuthorization with oAuth
Authorization with oAuth
Vivastream
 
O auth how_to
O auth how_toO auth how_to
O auth how_to
vivaqa
 

Similar to LinkedIn OAuth: Zero To Hero (20)

Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02
 
OAuth
OAuthOAuth
OAuth
 
Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02Maintest 100713212237-phpapp02-100714080303-phpapp02
Maintest 100713212237-phpapp02-100714080303-phpapp02
 
Maintest3
Maintest3Maintest3
Maintest3
 
MainFinalOAuth
MainFinalOAuthMainFinalOAuth
MainFinalOAuth
 
Api security
Api security Api security
Api security
 
An introduction to OAuth 2
An introduction to OAuth 2An introduction to OAuth 2
An introduction to OAuth 2
 
Oauth Php App
Oauth Php AppOauth Php App
Oauth Php App
 
Implementing OAuth with PHP
Implementing OAuth with PHPImplementing OAuth with PHP
Implementing OAuth with PHP
 
Silicon Valley Code Camp 2009: OAuth: What, Why and How
Silicon Valley Code Camp 2009: OAuth: What, Why and HowSilicon Valley Code Camp 2009: OAuth: What, Why and How
Silicon Valley Code Camp 2009: OAuth: What, Why and How
 
O auth2.0 guide
O auth2.0 guideO auth2.0 guide
O auth2.0 guide
 
Secure Webservices
Secure WebservicesSecure Webservices
Secure Webservices
 
Protecting your APIs with OAuth 2.0
Protecting your APIs with OAuth 2.0Protecting your APIs with OAuth 2.0
Protecting your APIs with OAuth 2.0
 
Stateless Auth using OAUTH2 & JWT
Stateless Auth using OAUTH2 & JWTStateless Auth using OAUTH2 & JWT
Stateless Auth using OAUTH2 & JWT
 
REST API Authentication Methods.pdf
REST API Authentication Methods.pdfREST API Authentication Methods.pdf
REST API Authentication Methods.pdf
 
Authorization with oAuth
Authorization with oAuthAuthorization with oAuth
Authorization with oAuth
 
O auth how_to
O auth how_toO auth how_to
O auth how_to
 
oauth-for-credentials-security-in-rest-api-access
oauth-for-credentials-security-in-rest-api-accessoauth-for-credentials-security-in-rest-api-access
oauth-for-credentials-security-in-rest-api-access
 
OAuth2 and OpenID with Spring Boot
OAuth2 and OpenID with Spring BootOAuth2 and OpenID with Spring Boot
OAuth2 and OpenID with Spring Boot
 
Webapp security (with notes)
Webapp security (with notes)Webapp security (with notes)
Webapp security (with notes)
 

Recently uploaded

Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
FIDO Alliance
 

Recently uploaded (20)

The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdfThe Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
 
Intro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераIntro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджера
 
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
 
(Explainable) Data-Centric AI: what are you explaininhg, and to whom?
(Explainable) Data-Centric AI: what are you explaininhg, and to whom?(Explainable) Data-Centric AI: what are you explaininhg, and to whom?
(Explainable) Data-Centric AI: what are you explaininhg, and to whom?
 
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsContinuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
 
Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
 
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdfHow Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
 
Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...
Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...
Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...
 
Event-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream ProcessingEvent-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream Processing
 
Extensible Python: Robustness through Addition - PyCon 2024
Extensible Python: Robustness through Addition - PyCon 2024Extensible Python: Robustness through Addition - PyCon 2024
Extensible Python: Robustness through Addition - PyCon 2024
 
Introduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxIntroduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptx
 
TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024
 
ERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage IntacctERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage Intacct
 
WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024
 
Portal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russePortal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russe
 
Working together SRE & Platform Engineering
Working together SRE & Platform EngineeringWorking together SRE & Platform Engineering
Working together SRE & Platform Engineering
 
Your enemies use GenAI too - staying ahead of fraud with Neo4j
Your enemies use GenAI too - staying ahead of fraud with Neo4jYour enemies use GenAI too - staying ahead of fraud with Neo4j
Your enemies use GenAI too - staying ahead of fraud with Neo4j
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
 
Long journey of Ruby Standard library at RubyKaigi 2024
Long journey of Ruby Standard library at RubyKaigi 2024Long journey of Ruby Standard library at RubyKaigi 2024
Long journey of Ruby Standard library at RubyKaigi 2024
 
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The InsideCollecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
 

LinkedIn OAuth: Zero To Hero

  • 1. ZERO to HERO The LinkedIn OAuth Dance
  • 2. Using the LinkedIn API is easy... If you’re lord of the dance.
  • 4. OAuth is an open authorization standard for APIs that does away with logins and passwords to grant authorization to a third-party. Some familiarity with OAuth is assumed, going forward. http://oauth.net/core/1.0a
  • 5. Will any old OAuth library work with LinkedIn? LinkedIn uses OAuth 1.0a and requires HTTP Header-based Authorization. Some OAuth libraries don’t yet support OAuth 1.0a, or are built with lenient OAuth implementations in mind. LinkedIn’s OAuth is strict.Your library might not be up to snuff.
  • 6. You might have to get your hands dirty.
  • 7. Quick Glossary That Won’t Be So Quick Because This Stuff Actually Takes Time to Learn oauth_callback - This is either a URL or “oob” and denotes where to direct a user on your server following the “authorize” step. out of band - A form of OAuth where no URL callback is used and an oauth_verifier challenge is presented instead requestToken - a token issued to you as a result of asking for it. Re-used in the authorize step accessToken - a token issued to you at the end of the cycle. Represents a LinkedIn member and authorizes you to access resources on their behalf authorize - After getting a request token, you send the user to a signed authorize URL where they grant access to your application token secret - a string returned on the requestToken and accessToken steps, used in conjunction with your consumer secret when signing certain requests. consumer key - Your API key. consumer secret - Your API secret. Used in the signing of all requests. oauth_nonce - A random string, unique in every request. oauth_timestamp - Epoch time in seconds, synced within 5 minutes of LinkedIn’s clock oauth_token - Specified in many contexts, either the request token or access token. oauth_verifier - A returned to you when your oauth_callback is invoked, or hand-entered by a user in the out-of-band flow.
  • 8. All OAuth-based requests are very similar.You’re identifying a resource that you want to make a request to, you’re building a string that describes the request and your credentials for making it, and then you’re signing that string using a set of secrets. It’s like addressing an envelope where the address and stamp not only describe the destination but also the contents. The OAuth 1.0a Request Cycle
  • 9. 1) You ask for a request token and specify your callback 2) You direct the user to our authorization screen 3) You either receive a callback at a URL you specified, or the member enters a PIN code (out-of-band authentication) 4) You ask for an access token 5) You make API calls! The OAuth 1.0a Request Cycle
  • 10. Building a requestToken request requires the following: HTTP Method, Request URI, oauth_callback, oauth_consumer_key, oauth_nonce, oauth_signature_method, oauth_timestamp, and oauth_version. Getting a Request Token
  • 11. First build your string to sign. We’ll use these values for this example. HTTP Method POST Request URI https://api.linkedin.com/uas/oauth/requestToken oauth_callback http://linkedin.realitytechnicians.com:3000/oauth_consumers/taylor_singletary/callback oauth_consumer_key dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV oauth_nonce 24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs8u0tk oauth_signature_method HMAC-SHA1 oauth_timestamp 1260811626 oauth_version 1.0 Getting a Request Token
  • 12. First build your string to sign. These parameters get sorted alphabetically, each value is URL escaped, and than concatenated into a single string. POST&https%3A%2F%2Fapi.linkedin.com%2Fuas%2Foauth %2FrequestToken&oauth_callback%3Dhttp%253A%252F %252Flinkedin.realitytechnicians.com %253A3000%252Foauth_consumers %252Ftaylor_singletary%252Fcallback %26oauth_consumer_key%3DdTgSkaRKZjEnS1vAUu6e7- aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV %26oauth_nonce %3D24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs8u0tk %26oauth_signature_method%3DHMAC- SHA1%26oauth_timestamp %3D1260811626%26oauth_version%3D1.0 Getting a Request Token
  • 13. Create your Authorization HTTP Header & Issue the Request Now we sign this string using our consumer secret and create an HTTP Authorization header,. The signature should be placed in the oauth_signature value. Authorization: OAuth oauth_nonce="24FZIeB9tNGlnV9p7nnP1yelQbTNFjU7R5qs 8u0tk", oauth_callback="http%3A%2F %2Flinkedin.realitytechnicians.com %3A3000%2Foauth_consumers%2Ftaylor_singletary %2Fcallback", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1260811626", oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7- aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV", oauth_signature="Ws%2B%2FH%2FonYnsZXyZwyEhgL %2Bboq8s%3D", oauth_version="1.0" Getting a Request Token
  • 14. Evaluate the requestToken response Now we issue this request to the requestToken endpoint, and if all is successful, you’ll get something like the following URL encoded response: oauth_token=f7868c3a-7336-4662- a6d1-3219fb4650d1&oauth_token_secret=45e0ccd0-0c5 d-431e-831a-63f10552338a&oauth_callback_confirmed =true The oauth_token field is now your request token, and the oauth_token_secret will be used for signing your request for an access token. oauth_callback_confirmed just gives you confirmation that we recognized your oauth_callback parameter. You’ll want to “hold on” to the oauth_token and oauth_token_secret until you’ve completed the access token step. Getting a Request Token
  • 15.
  • 16. Build your authorization URL Now that we have a request token, we can build the URL to authorize the user. We’ll then redirect the user to this URL so they can grant your application access. An authorization URL is simply this end point: https://api.linkedin.com/uas/oauth/authorize with a query parameter tacked on called oauth_token. The value for this parameter is equal to the request token you received in the previous step. With this same example, you’d direct the user to this URL: https://api.linkedin.com/uas/oauth/authorize? oauth_token=f7868c3a-7336-4662-a6d1-3219fb4650d1 The user needs to land on this page within 5 minutes of your request token cycle. You should not pass an oauth_callback parameter to this page (you already did that in the request token step). Authorizing the member
  • 17. Send the user to LinkedIn’s Authorization Page The user will then be sent to our authorization page. When completed the user will either be sent back to your oauth_callback URL or presented with a series of digits they’ll be instructed to hand-enter into your application (if you are performing out-of-band authentication). Authorizing the member
  • 18. OAuth Callback vs. Out of Band After authorizing your application, the After authorizing your application, the user will be sent to the URL you specified member is presented with a PIN code. as the oauth_callback. Your callback will receive In your application, you an oauth_token and should now present a UI oauth_token_secret; these allowing the user to are the same as your hand-enter the PIN request tokens. code. You’ll also receive an After receiving the PIN oauth_verifier parameter, code, you’ll be using it which you will need to for the accessToken step attach as part of your as the oauth_verifier. accessToken request in the next step.
  • 19. Exchanging a request token for an access token.
  • 20. Prepare your signing secret Regardless of whether you used out-of-band authentication or not, you’ll now be equipped with a request token, an oauth_token_secret, and an oauth_verifier. You’re now going to exchange that request token for an access token, imbued with the permission of the LinkedIn member to act on their behalf. In LinkedIn’s strict OAuth implementation, a request for an access token must be signed using both your consumer secret and the oauth_token_secret you received as when retrieving your request token. Many existing OAuth libraries do not properly incorporate the oauth_token_secret in this step. Your signing key will be in the format of: url_escape(consumer_secret)&url_escape(oauth_token_secret) Getting an Access Token
  • 21. Now build your string to sign. We’ll use these values for this example. Your oauth_token is your requestToken. HTTP Method POST Request URI https://api.linkedin.com/uas/oauth/accessToken oauth_consumer_key dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV oauth_nonce WqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3UI oauth_signature_method HMAC-SHA1 oauth_timestamp 1260811635 oauth_token f7868c3a-7336-4662-a6d1-3219fb4650d1 oauth_verifier 75553 oauth_version 1.0 Getting an Access Token
  • 22. Now build your string to sign. These parameters get sorted alphabetically, each value is URL escaped, and than concatenated into a single string. POST&https%3A%2F%2Fapi.linkedin.com%2Fuas%2Foauth %2FaccessToken&oauth_consumer_key %3DdTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e- klzBC1a4TKCnSgClWV%26oauth_nonce %3DWqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3UI %26oauth_signature_method%3DHMAC- SHA1%26oauth_timestamp%3D1260811635%26oauth_token %3Df7868c3a-7336-4662- a6d1-3219fb4650d1%26oauth_verifier %3D75553%26oauth_version%3D1.0 Getting an Access Token
  • 23. Create your Authorization HTTP Header & Issue the Request Now we sign this string using the secret we constructed from our consumer secret and oauth_token_secret, then create an HTTP Authorization header, including the signature as the oauth_signature value, and oauth_nonce, oauth_callback, oauth_signature_method, oauth_timestamp, oauth_consumer_key, oauth_token, oauth_verifier, and oauth_version. Authorization: OAuth oauth_nonce="WqKwyyrjQLgpaeJIB6MWKKmDOIpxKBrz0lLabSO3 UI", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1260811635", oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7- aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV", oauth_token="f7868c3a-7336-4662-a6d1-3219fb4650d1", oauth_verifier="75553", oauth_signature="gp3C1jCOgRyN106UIe0FLTzOmu8%3D", oauth_version="1.0" Getting an Access Token
  • 24. Evaluate the accessToken response Now we issue this request to the accessToken endpoint, and if all is successful, you’ll get something like the following URL encoded response: oauth_token=fb74aed1- eb7d-4f3f-855c-137000243df8&oauth_token_secret=4e7f56 2d-04b1-4488-8162-95a2454ae9a8 The oauth_token field is now your access token, and the oauth_token_secret will be used for signing all requests on behalf of the member. You’ll want to “hold on” to the oauth_token and oauth_token_secret for as long as you want to act on the member’s behalf. A LinkedIn member may specify that an access token is valid only for a certain period of time (or forever), but can revoke access on LinkedIn.com at any time. Getting an Access Token
  • 25. You’ve acquired an access token! But don’t hang up your dancing shoes yet.
  • 26. LinkedIn is about people. LinkedIn is about you.
  • 27. Making API resource requests is very similar to other operations. You’ll need your access token, oauth_token_secret, and your API keys to continue. We’re going to ask for our own profile from LinkedIn’s people resource. In LinkedIn resource URLs, the tilde (“~”) character represents the member associated with your access token. LinkedIn’s API works best when you explicitly tell it what you are looking for, so we’re asking for the member’s id, first name, last name, and their headline only. The resource URL for this request would be: When URL encoding this resource in the following OAuth signing steps, you’ll want to ensure that the tilde character does not become escaped. The field selectors are not query parameters, but part of the path of the URI itself. Requesting your own profile
  • 28. Start by building your string to sign. We’ll use these values for this example. Your oauth_token is your access token. HTTP Method GET Request URI https://api.linkedin.com/v1/people/~:(id,first-name,last-name,headline) oauth_consumer_key dTgSkaRKZjEnS1vAUu6e7-aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV oauth_nonce Tv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0XhmY oauth_signature_method HMAC-SHA1 oauth_timestamp 1260915816 oauth_token fb74aed1-eb7d-4f3f-855c-137000243df8 oauth_version 1.0 Requesting your own profile
  • 29. Start by building your signature base string. These parameters get sorted alphabetically, each value is URL escaped, and than concatenated into a single string. GET&https%3A%2F%2Fapi.linkedin.com%2Fv1%2Fpeople%2F~ %3A%28id%2Cfirst-name%2Clast-name%2Cheadline %29&oauth_consumer_key%3DdTgSkaRKZjEnS1vAUu6e7- aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV %26oauth_nonce %3DTv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0XhmY %26oauth_signature_method%3DHMAC- SHA1%26oauth_timestamp%3D1260915816%26oauth_token %3Dfb74aed1- eb7d-4f3f-855c-137000243df8%26oauth_version%3D1.0 Requesting your own profile
  • 30. Create your Authorization HTTP Header & Issue the Request Now we sign this string using our consumer secret in conjunction with your access token’s oauth_token_secret (just like in our previous steps) and create an HTTP Authorization header,. The signature should be included as the oauth_signature value. Authorization: OAuth oauth_nonce="Tv4o9eX4Dmui9uW5otBVweTI28O0YmIWPnRhu0Xh mY", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1260915816", oauth_consumer_key="dTgSkaRKZjEnS1vAUu6e7- aYC00UilBTwnXHpLH7NyL2e-klzBC1a4TKCnSgClWV", oauth_token="fb74aed1-eb7d-4f3f-855c-137000243df8", oauth_signature="4imDw81fRdCI%2FBBoo0vwix5giVo%3D", oauth_version="1.0" Requesting your own profile
  • 31. Evaluate the XML response Now we issue this request to the people resource, and if all is successful, you’ll get something like the following XML response, with your own profile values in place of my own. <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <person> <id>esIpa2xh0v</id> <first-name>Taylor</first-name> <last-name>Singletary</last-name> <headline>Technical Evangelist at LinkedIn</headline> </person> If the access token is invalid, or your signature was not properly calculated, you will receive a 401 Unauthorized error. There is always interesting debugging information in the XML body of a failed request and the HTTP headers we return to you. Maybe your timestamp was off by a few minutes? Maybe your signature was invalid? Maybe the access token is no longer valid? Requesting your own profile
  • 33. OAuth is complicated, and there are a number of things that go wrong. Here are some tips. Every error response we send you will contain an XML body describing the error, including a timestamp representing API server time. Some OAuth-based requests will also return an oauth_problem HTTP header. Make sure that your server’s system clock is in sync with ours. oauth_callback should only be provided on the requestToken step. oauth_verifier is required in the accessToken step. PUT & POST operations typically have XML Content-Types. Your OAuth library should exclude the request body in signature calculations as a result. For the access token step, remember that the request token’s oauth_token_secret must be used as part of your signing key. Likewise, for API resource requests, your access token’s oauth_token_secret must be used as part of your signing key. At this time, LinkedIn only supports HTTP header-based OAuth. Make sure that you are passing your OAuth credentials as an Authorization HTTP header, not as query parameters attached to the request. Troubleshooting
  • 34. Working with LinkedIn’s OAuth OAuth Authentication Common Issues with OAuth Authentication General OAuth OAuth 1.0a Spec Beginner’s Guide to OAuth Client Libraries & Community Code Ruby PHP Java .NET Further Reading
  • 35. I hope you had the time of your life mastering the OAuth dance. Thanks to all the great people in the LinkedIn Developer Community!