A React application has a standard OAuth flow that grants access to Github with no scope. The user can go through another OAuth flow to grant repo access to the application. How can the application tell if the user has granted the repo scope or not?
This looks like it would be doable using the /application/grants API, but that API is scheduled to be deprecated and it only accepts Basic Auth. What's the replacement?
Related
I'm trying to create GitHub personal access tokens programmatically using the endpoint https://github.com/login/oauth/access_token and a GitHub App, following the device flow and code exchange.
The creation seems to be working fine and gets a response with the token
However, our account has SSO integration, and this requires all tokens to be authorized by the SSO in order to work, so the token receives a 404 response for any call to our private repositories, which I believe is related to the lack of SSO authorizing it
I can't find any documentation specifying how to authorize tokens generated via the API
IMPORTANT: I know how to authorize tokens generated via the Github Web UI, I'm talking about tokens generated via the API endpoint https://github.com/login/oauth/access_token device-flow, with code exchange! Those tokens are not available at the UI and I cannot find how to authorize them
Any idea on how to solve it?
This doesn't seem to be documented anywhere, but you need to use user oauth2
GitHub clone repo with fine-grained personal access tokens (PAT)
I thought it would be simple to use Graph API to read my own user profile or another signed-in user profile but no luck so far.
I created an Azure app with only the following:
a) Client Secret
b) Delegated API permission of User.Read only
I then used the following simple code to try to read my own profile but it returned (400) Bad Request even though I can see that a token was returned successfully.
I was wondering if I could use the same Azure app to read another user's profile provided that a sign-in prompt could be created to switch account.
Any thoughts?
The me endpoint requires a user context. You're using the client credentials grant type, which is for client apps to use in an app-only context. The app has no awareness of who "me" is, or what "your" profile is because you haven't provided a user.
For the app to read the profiles of other users in the client credentials flow, you need to add one of the MS Graph application-type permissions, and send a request to the https://graph.microsoft.com/v1.0/users enpoint
Get user API endpoint
My app logic (Android, iOS and Web) is all written in my server.
Since things got complicated, I decided to build my server as a REST web service so querying it will contain logic in the header.
My login flow is pretty simple, and I somehow tried to copy from Facebook API:
The user login to Facebook.
The user receive a Facebook access token
The access token is sent to my server with some other identifiers
The server checks with Facebook that the access token is valid with Facebook and that the other identifiers match the ones on Facebook.
The server returns an access token to the user, which he should use in each query until it expires.
The problem is that I didn't add any other restrictions like endpoints limitations (scopes) and stuff like this, so an access token generated by my server grant you access to each part of my api.
I think that inventing the wheel here will be foolish, so I'm looking for a framework or a generic solution that will allow me to add logic to the access tokens in a simple way.
I read about OAuth, but my concern that its more about user sharing with other users, but I only want to use it is login flow and scope protector.
Is it possible with OAuth ? Are there alternative to OAuth ?
That's possible with OAuth 2.0 and in fact one of the objectives: you may issue and use access tokens that have particular "scopes" (an OAuth 2.0 concept) associated to them that could relate to permissions that the client has (e.g. read/write, API A, API B).
But you need to issue your own access tokens from your own Authorization Server. You could allow users to login to that Authorization Server with their Facebook account.
Question: Is it possible for application which associated with business manager to obtain ads_management permissions and make server-to-server calls using appId|appSecret as access token.
If yes then what are the correct steps to obtain those permissions for an app?
If no then is there a way to get access token for the user with such permissions which never expires?
Details: As stated in FB documentation, in order to make server-to-server requests without need to obtain and refresh access tokens we may use pair of app Id and app secret in form of appId|appSecret.
Our application now has the following permissions:
- email
- public_profile
- user_friends
In order to make calls to Ads API our application has to have ads_management permissions. Currently we make calls to Ads API through user-level access token and this is not preferable for us as this token requires refreshes which must be done manually using browser interaction (we can't obtain access token programmatically)
You may be confusing App Access Tokens (which allow you to make calls on behalf of the app itself) with permissions (which an individual user grants you to act on their behalf) - you'll always need a user token to update things belonging to a user.
A user, who's an admin of the ad account you want to manage, needs to grant your app ads_management permission - once they've done that, the OAuth flow gives you an access token to make API calls on their behalf, and that token doesn't expire for up to 60 days (after which point they need to come back to your site/app while logged into Facebook for you to get an updated token)
In the context of Business Manager, that user must be someone that has access via Business Manager to the assets (ad acccounts and pages) you want to update via the API
If your app has Standard access to the Ads API, you can also use 'System Users' to make sessionless API calls to update the assets of the business: https://developers.facebook.com/docs/marketing-api/businessmanager/systemuser/v2.2
More info about login here:
https://developers.facebook.com/docs/marketing-api/guides/chapter-1-Setup-and-Authentication
https://developers.facebook.com/docs/facebook-login/access-tokens
Is there any API based approach to grant permissions for 'client side login without javascript SDK'.
Here my application logs in the user and when dialog/oauth request is fired I want everything to be performed(application authorization and permission granting) through a C program.
Can I do it using some API?
Not possible.
Facebook using oAuth for authorization and permission granting, these steps needs to be performed at facebook servers only.
No third party application can accept user credentials and grant permission on his behalf.