I'm trying to get RPT without permission ticket only using resource names. While this method works when working with policies, it doesn't seem to work with users sharing their resources through account page (returns access denied). For some reason when user A shares a resource with user B, user B can get RPT for this resource only if he:
a) Requests all his permissions
or
b) Requests specific permissions by id (not name)
Is this intended behaviour? If so how can i overcome this problem and still use only resource names?
Getting RPT by resource name (doesn't work with sharing):
curl "$PROTOCOL://$HOST:$PORT/auth/realms/$REALM/protocol/openid-connect/token" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&permission=$RESOURCE_NAME&audience=$RESOURCE_CLIENT_ID"
Getting RPT by resource id (works with sharing):
curl "$PROTOCOL://$HOST:$PORT/auth/realms/$REALM/protocol/openid-connect/token" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&permission=$RESOURCE_ID&audience=$RESOURCE_CLIENT_ID"
Getting RPT for all resources (works with sharing):
curl "$PROTOCOL://$HOST:$PORT/auth/realms/$REALM/protocol/openid-connect/token" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&audience=$RESOURCE_CLIENT_ID"
This issue is fixed in version 6.0
Related
link for the docs is here and the curl command is:
curl \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>"\
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/OWNER/REPO/teams
I've given personal access token as my Authorization but it throws as not found.
Any suggestions on how to get it? My repo was assigned to 3 teams even tho it throws not found
i'm the owner of the org and trued to hit with my PAC even tho its giving me the same 404 statusCode.
for example :
this is the link for getting the contributors but for teams i've this but it is giving me 404
I am trying to make a call https://api.github.com/repos/OWNER/REPO/actions/runners/registration-token with an users personal access token that has repo permissions.
To do so I am testing with:
curl -I -X POST -H "Authorization: token <OAUTH_TOKEN> Accept: application/vnd.github.v3+json" https://api.github.com/repos/<owner>/<repo-name>/actions/runners/registration-token which gives me Bad Credentials error
curl -I -H "Authorization: token <OAUTH_TOKEN>" https://api.github.com/users/<USER_NAME> ->
x-oauth-scopes: repo
x-accepted-oauth-scopes:
According to this: https://docs.github.com/en/rest/actions/self-hosted-runners I need to provide an oauth token with repo access.
If I curl the user curl -H "Authorization: token <OAUTH_REPO_TOKEN>" https://api.github.com/users/<USER>/repos -> []. But if I go to the repo and check settings -> Collaborators And Teams, the user is listed as part of the team with admin privledges, and I have also added an entry for the user directly.
Is there something I am missing? What permissions do I need to add to fix this?
I needed to call the API with a user name as well. For example:
curl -I -X POST -u <USER>:<OAUTH_REPO_TOKEN> -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/<owner>/<repo-name>/actions/runners/registration-token. Passing a -v option reveals that it was not setting a username, and causing github to reject the call.
How I can set user attribute value using Keycloak Rest API?
Update: The /auth path was removed starting with Keycloak 17 Quarkus distribution. So you might need to remove the /auth from the endpoint calls presented on this answer.
To set a user attribute using the Keycloak Admin REST API; you use the endpoint:
PUT <KEYCLOAK_HOST>/auth/admin/realms/<YOUR_REALM>/users/<USER_ID>
with the payload
{"attributes":{"<ATTRIBUTE_NAME>":["<ATTRIBUTE_VALUE>"]}}
the <USER_ID> you can get it using the endpoint:
GET <YOUR_KEYCLOAK_DOMAIN>/auth/admin/realms/<YOUR_REALM>/users/?username=<THE_USERNAME>
from the JSON response, extract the field id.
Step-by-Step:
You can get that information using the Keycloak Admin REST API; to call that API, you need an access token from a user with the proper permissions. For now, I will be using the admin user from the master realm:
curl https://${KEYCLOAK_HOST}/auth/realms/master/protocol/openid-connect/token \
-d "client_id=admin-cli" \
-d "username=$ADMIN_NAME" \
-d "password=$ADMIN_PASSWORD" \
-d "grant_type=password"
You will get a JSON response with the admin's token. Extract the value of property access_token from that response. Let us save it in the variable $ACCESS_TOKEN for later reference.
To get the user id from your realm $REALM_NAME:
curl -X GET https://${KEYCLOAK_HOST}/auth/admin/realms/${REALM_NAME}/users/?username=${USERNAME}&exact=true \
-H "Content-Type: application/json" \
-H "Authorization: bearer $ACCESS_TOKEN"
From the response extract the user id for example as follows
jq -r .[].id
Or even cleaner is to passed to the
To set the user attribute:
curl -X PUT https://${KEYCLOAK_HOST}/auth/admin/realms/${REALM_NAME}/users/${USER_ID} \
-H "Content-Type: application/json" \
-H "Authorization: bearer $ACCESS_TOKEN" \
-d '{"attributes":{"<ATTRIBUTE_NAME>":["<ATTRIBUTE_VALUE>"]}}'
You can also have a look at setUser script on my GitHub repo.
While trying to use encryption/decryption feature of spring cloud config server with Pivotal Cloud Foundry's p-config-server service which is configured with a symmetric key for encryption, I am getting a 403 forbidden response which calling /decrypt on config server .
I am able to call the /encrypt endpoint successfully for encrypting values using below sample curl -
curl --location --request POST 'https://config-xxxx.apps.xxx.com/encrypt' \
--header 'Authorization: bearer <cf oauth_token here>' \
--header 'Content-Type: text/plain' \
--data-raw 'sample data'
But when trying to decrypt those values using /decrypt, I am getting 403 Forbidden error -
{
"error": "access_denied",
"error_description": "invalid issuer"
}
Sample curl for decryption -
curl --location --request POST 'https://config-xxxx.apps.xxx.com/decrypt' \
--header 'Authorization: bearer <cf oauth_token here>' \
--header 'Content-Type: text/plain' \
--data-raw '<encrypted value from previous step>'
In pivotal's config server documentation though there are reference to /encrypt but nothing related to /decrypt pivotal config server
Any pointers ?
In the Pivotal/Tanzu Spring Cloud Services (commercial product), the /encrypt API is exposed to anyone with the admin scope or to anyone that is a Space Developer in the space of the service.
The /decrypt endpoint is not exposed specifically, so you're not allowed to access with the same credentials, hence why you're seeing a 403.
My quick read of the code is that you'd need a token with scope config_server_<guide>.read to access that endpoint. Where <guid> is the config server's service guide (run cf service --guid <name> to obtain the guide).
To make that work, you'd need to get a token from the bound service or a service key, the latter is easier:
Run cf create-service-key <service_instance> decrypt-key
Run cf service-key <service_instance> decrypt-key
Run export TOKEN=$(curl -vv <access_token_uri> -d 'grant_type=client_credentials' -d 'client_id=<client_id>' -d 'client_secret=<client_secret>' | jq -r .access_token) where the values in <...> are from the output of #2.
Run curl -vv '<uri>/decrypt' -H "Authorization: bearer $TOKEN" -H 'Content-type: text/plain' -d '<encrypted-value>'
These depend on a Bash shell. You can do them on Windows, but the commands will vary. It also uses jq to make extracting the token easier. You could split the command in step #3 into two steps, fetching with curl and manually exporting TOKEN.
How can we access the Box API using the refresh token that is generated? I have followed all the steps to generate the access token and refresh token but I cannot find it anywhere how can I access the API using refresh token.
This is what I have right now:
curl -X GET -H "Authorization: Bearer <Access-Token>" "https://api.box.com/2.0/folders/0"
I am not able to do this :
curl -X GET -H "Authorization: <Refresh-Token>" "https://api.box.com/2.0/folders/0"
or
curl -X GET -H "Authorization: Bearer <Refresh-Token>" "https://api.box.com/2.0/folders/0"
Any idea how we can use the Refresh token in an API call?
The access_token is used to make Box Content API calls.
The refresh_token is used to obtain a new access_token & refresh_token pair since access_tokens expire in around 60 minutes.
curl https://api.box.com/oauth2/token
-d 'grant_type=refresh_token' \
-d 'refresh_token=<MY_REFRESH_TOKEN>' \
-d 'client_id=<MY_CLIENT_ID>' \
-d 'client_secret=<MY_CLIENT_SECRET>' \
-X POST