topic Re: Authentication to REST API with OAuth2 in Nuxeo Forum

Authentication to REST API with OAuth2

chouinard_ — Mon, 21 Sep 2015 21:43:22 GMT

Hi, I'm using REST API within a Web Java App to get query results which works great but the next step is to authenticate without having to use user's passwords.

Is using OAuth2 to authenticate, the best way to do it ?

I've tried it and so far I can't get the response that will give me the authorization code to get the access token via Java code. When I try with http requests, it's ok but I have to accept (through oauth2Grant.jsp button), but I am missing something with using it with a Java HttpURLConnection...

Thanks.

Re: Authentication to REST API with OAuth2

Arnaud_Kervern — Thu, 24 Sep 2015 11:42:48 GMT

Hi,

I think there are several others solutions that fit better to your case. As you do not want to add any new user authentication step:

if your queries are executed server side on the same host, the easiest way is to use nuxeo-platform-login-portal-sso. A simple query header with a shared secret and the authenticated username.
if your queries are server side without a DMZ, you have to sign the request to ensure it goes safe. In this case i'll recommend you to use Oauth1 2 legged. Take a look to this jersey client filter to see how to handle it: https://github.com/nuxeo/nuxeo.io-manager/blob/master/nuxeo-io-manager/src/main/java/org/nuxeo/io/connect/OauthAuthFilter.java.
if your queries are client <-> server, you can use nuxeo-platform-login-token, when authenticating a user; you'll ask Nuxeo to give you a token that you'll add to each user requests.

Re: Authentication to REST API with OAuth2

chouinard_ — Thu, 24 Sep 2015 16:27:12 GMT

Hi, thanks for the answer.

Re: Authentication to REST API with OAuth2

Arnaud_Kervern — Fri, 25 Sep 2015 15:01:29 GMT

Even if I recommend you to use something easier to handle HTTP request; like jersey-client, to query our REST API, you just need to

Re: Authentication to REST API with OAuth2

pibou_Bouvret — Thu, 28 Apr 2016 09:12:53 GMT

Where can we find some documentation about using nuxeo-platform-login-token from a client application ?