OAuth 2.0 has become the defacto way to authenticate to IBM Connections and cloud services such as IBM Connections Cloud, Google and SalesForce and is *the* way to bridge systems. Despite being very powerful surprisingly few IBM Connections developers actually know of it or enough about it. OAuth 2.0 has been in IBM Connections for many releases and allows other services or API programs to impersonate users – and hence work as the user – without the user relinquishing control of their credentials. It’s very powerful stuff. This session acts as a primer on OAuth 2.0 for developers and administrators teaching you the ropes as well as teaching developers how to start utilizing OAuth 2.0 for IBM Connections on-premises as well as for IBM Connections Cloud. If you are developing for IBM Connections this is for you. Be warned – there will be code…

1. OAuth 2.0 for developers - the
technology you need but never
really learned
Mikkel Flindt Heisterberg
OnTime® by IntraVision

2. PLATINUM & CHAMPAGNE SPONSORS
GOLD SPONSORS
SILVER SPONSORS
BRONZE SPONSORS

3. Agenda
• The problem we are trying to solve
• Demo (OAuth for users i.e. almost real people)
• The flow…
• OAuth for administrators
• OAuth for developers i.e. real people
• Q&A
Mikkel Flindt Heisterberg
TwiQer: @lekkim
E-mail: mV@intravision.dk
hQp://lekkimworld.com
hQp://slideshare.net/lekkim

4. The problem we are trying to solve

5. The problem we are trying to solve
Give me your Social
site username and
password and we can
play…

6. The problem we are trying to solve
Doesn’t really trust that
shiny new site – or IBM
Connec>ons for that
ma@er…
Give me your Social
site username and
password and we can
play…

7. The problem we are trying to solve
I support OAuth 2.0
and don’t want your
creden>als – just
authorize me to work
on your behalf…

8. The problem we are trying to solve
1
2
3

9. it’s about le,ng a service
access user data without
knowing the users creden7als...
- or without the user being there...

10. demo

11. Demo safety

12. it’s not as simple as that
but almost...

13. The flow…
CLIENT
PROVIDER
USER
1

14. The flow…
CLIENT
PROVIDER
USER
2

15. The flow…
CLIENT
PROVIDER
USER
3

16. The flow…
CLIENT
PROVIDER
USER
4

17. The flow…
CLIENT
PROVIDER
USER
5

18. The flow…
CLIENT
PROVIDER
USER
6

19. The flow…
CLIENT
PROVIDER
USER
7

20. The flow…
CLIENT
PROVIDER
USER
8

21. The flow…
CLIENT
PROVIDER
USER
9

22. but less cartoony and with
real words this Zme...

23. 1) User accesses site and logs in
CLIENT
PROVIDER
USER
1

24. 2) The site checks to see if it has Tokens for the Provider
in its credenGal store
CLIENT
PROVIDER
USER
2

25. 3) The site sends a redirecGon to the client telling it to
go authorize it at the Provider. The URL contains the
Client redirect_uri and client_id
CLIENT
PROVIDER
USER
3

26. 4) The user use the redirect URL and go the provider
and log ins if not already logged in. Then he authorizes
the Client
CLIENT
PROVIDER
USER
4

27. 5) The Provider returns a Gme limited
authorizaGon_code in a redirecGon URL to the user
CLIENT
PROVIDER
USER
5

28. 6) The User sends the authorizaGon_code to the Client
CLIENT
PROVIDER
USER
6

29. 7) Out-of-band the Client sends the authorizaGon_code,
it’s client_id, redirect_uri and secret to the Provider
CLIENT
PROVIDER
USER
7

30. 8) The Provider exchange the authorizaGon_code for a
short lived access_token (yellow) and a longer lived
refresh_token (blue)
CLIENT
PROVIDER
USER
8

31. 9) When the User now access the site it can use the
access_token to work as the User. Even if the user is not
there i.e. not logged into the site…
CLIENT
PROVIDER
USER
9

32. If not you should ask now…

33. WSADMIN
COMING UP

34. OAuth for administrators
• IBM ConnecZons use the built in OAuth
provider from WebSphere ApplicaZon
Server
• Administrators we responsible for
registering the app with the OAuth
provider
• You use – you guessed it – wsadmin
commands to do it…

35. OAuth for administrators
execfile(”oauthAdmin.py”)
OAuthApplicationRegistrationService.addApplication(
”myapp1”, ”My App1", "https://www.renovations.com/oauth/
redirect")
OAuthApplicationRegistrationService.browseApplications()
[{display_name=My App1, client_id=myapp1,
client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxx, redirect_uri=
https://www.renovations.com/oauth/redirect}]
OAuthApplicationRegistrationService.deleteApplication(”myapp
1”)
The application with the id myapp1 was deleted successfully.
https://www-01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/
admin/admin/r_admin_common_oauth_manage_list.dita

36. I’M A
DEVELOPER

38. OAuth for developers
Generate the authorizaZon redirecZon URL and
have the user visit it. Suggest it’s done in a
separate window.
Syntax
https://<hostname>/oauth2/endpoint/connectionsProvider/
authorize?response_type=code&client_id=<client_id>
&callback_uri=<callback_uri>
Example
https://social.example.com/oauth2/endpoint/
connectionsProvider/authorize?
response_type=code&client_id=myapp1&callback_uri=
https://myapp.shinysite.com/oauth20_cb

39. OAuth for developers
Generate the authorizaZon redirecZon URL and
have the user visit it. Suggest it’s done in a
separate window.
Syntax
https://<hostname>/oauth2/endpoint/connectionsProvider/
authorize?response_type=code&client_id=<client_id>
&callback_uri=<callback_uri>
Example
https://social.example.com/oauth2/endpoint/
connectionsProvider/authorize?
response_type=code&client_id=myapp1&callback_uri=
https://myapp.shinysite.com/oauth20_cb
Must match exactly what the Provider have on record…

40. OAuth for developers
The user logs in to the Provider (if not already) and
authorizes you app…. Hopefully...

41. OAuth for developers
The Provider sends back a redirecZon URL to the
User containing an authorizaZon code causing
the User to send it to the Client
Syntax
https://<client_redirection_uri>?code=<authorization_code>
https://<client_redirection_uri>?oauth_error=<error_code>
Example
https://myapp.shinysite.com/oauth20_cb
?code=user_specific_auth_code

42. OAuth for developers
Client POST’s the authorizaZon code, client ID,
redirecZon URI and client secret to the Provider
out-of-band (server to server, not through User)
Syntax
POST /oauth2/endpoint/connectionsProvider/token HTTP/1.0
Host: <hostname>
Content-Length: <length>
Connection: Close
client_secret=<client_secret>&client_id=<client_id>&grant_type=authorization
_code&code=<auth_code>&callback_uri=<callback_uri>
Example
POST /oauth2/endpoint/connectionsProvider/token HTTP/1.0
Host: social.example.com
Content-Length: 161
Connection: Close
client_secret=my_secret_string&client_id=myapp1
&grant_type=authorization_code&code=user_specific_auth_code
&callback_uri=https://myapp.shinysite.com/oauth20_cb

43. OAuth for developers
Provider responds with (JSON) response with
access token, refresh token and expiry info. It
would be wise that the client saves the tokens…
Example
{
"access_token”: "d86o7UP0gj2c...GVzTPADsFv7”,
"token_type": "Bearer",
"expires_in": 43200,
"scope": "",
"refresh_token": "EWcVt5uaaXC9Pc...pTTgvrLRrs56gR”
}

44. OAuth for developers
To make requests on behalf of the User the Client
needs to set the access token in a header
Example
GET /connections/opensocial/oauth/rest
/activitystreams/@me/@all/@all HTTP/1.0
Host: social.example.com
Authorization: Bearer d86o7UP0gj2c...GVzTPADsFv7
Connection: Close
If the Client use an access token and receive a 401 back from the Provider it
should aQempt the refresh token to – well – refresh the access token. If that
also fails the User probably revoked access...

45. Mikkel Flindt Heisterberg
TwiQer: @lekkim
E-mail: mV@intravision.dk
hQp://lekkimworld.com
hQp://slideshare.net/lekkim