OAuth2 (SUSI) token creation plugin for aio-lib-ims
.
This plugin is intended to be used in conjunction with the aio-lib-ims
extending that to support browser based 3-legged OAuth2 authentication with IMS commonly known as SUSI flow.
For more information about the general setup of the Adobe I/O CLI IMS Plugin, please refer to aio-lib-ims
.
The 3-legged OAuth2 requires interaction with a browser as the initial authentication step to receive the authorization code may be involving multiple browser based steps. For example an IMS Enterprise integration may involve further redirects to a 3rd party for actual authentication.
Workflow:
- A 4-byte random pass-code is generated
- A localhost web server is created, listening at a port number
- An Adobe I/O Runtime web action is opened in the browser, passing in this pass-code, the localhost web server port number, the client id, and the IMS scope as query parameters
- The Adobe I/O Runtime web action will redirect to the IMS authorization endpoint, with the scope, client id and a csrf token as the
state
property (derived from the id, client id, scope and localhost port) passed in as query parameters - When the user is authenticated or an error occurs, the IMS endpoint will redirect to the Adobe I/O Runtime web action's
login-success
path - If the authentication is successful, the Adobe I/O Runtime web action will redirect to the localhost web server at the specified port (derived from the
state
property), and forward thestate
andcode
properties to the localhost web server call as query parameters - The localhost web server will pass on the authorization code to the library, and the library will call an IMS endpoint to exchange the authorization code for an access token and refresh token
- If the authentication is not successful, the Adobe I/O Runtime web action will report an error message in the web browser
The Adobe I/O Runtime function used (currently in testing) is coming soon.
Add the oauth2
context into your .aio
file in your current working directory (project folder), under ims
:
{
ims: {
contexts: {
oauth2: {
client_id: "YOUR_CLIENT_ID",
client_secret: "YOUR_CLIENT_SECRET",
scope: "YOUR_IMS_SCOPE"
}
}
}
}
The context can be named anything (here oauth2
is chosen for the context name).
The Client ID (called the OAuth2 credential in Developer Console) must allow the Adobe I/O Runtime action's login-success
path as the redirect URL. To this avail it should be configured as one of the redirect URI patterns of the OAuth2 credential in the Developer Console with the value:
https://aio-login\.adobeioruntime\.net/api/v1/web/default/applogin/login-success
Please note the backslash escaping of the dots in the URLs which is very important because this value must be a valid regular expression.
For example as shown in the following screenshot editing the credential:
Contributions are welcomed! Read the Contributing Guide for more information.
This project is licensed under the Apache V2 License. See LICENSE for more information.