This is basically the same question as How to get an access token without Box’s authorization page. I see that the Python package mentioned at the end (box.py) is no longer maintained because of support issues with Box. I suspect the solutions given might no longer work.
I'm just getting started with boxsdk and I want a way to periodically list the contents of my folder without requiring user interaction. This looks like the answer but it also seems very odd that a Developer Token, which is temporary, could be used for long-term queries like this.
I'm trying to work through boxsdk to see how I can implement the solution provided in 2014 but it would sure help to know whether or not it's still possible.
I just stumbled across this:
Introducing Developer Tokens
"There is no refresh token paired with the token"
That's from February 18, 2014.
Related
I am unable to push to git after generating a new personal access token. I've looked around at similar questions but think that I may have a more fundamental misunderstanding of how this works.
I got an email saying passwords were being phased out, so I generate a token and could no longer push a repo I've been working on using my password. From the instructions it looked like I can use the token just like a password, but to no avail. This is what the error looks like:
where I have pasted my token when prompted for password. (I've blacked out my username.) I am on Windows 10 and having checked my credentials manager do not appear to have credentials stored for github at the moment.
My questions are:
Ideas for immediate convenient fixes? I was seeing some suggestions about setting the remote-url, but a little concerned about doing this for every repo I have. I'd like to change my workflow minimally, if possible.
I'm probably grossly misunderstanding the point of the token. What is the "correct" way to set up a workflow to github? (Including maybe big changes that might take me a weekend to set up correctly, in a few weeks from now, say.) Am I supposed to set up a 2FA? (Will this change my web login at all?) Why is this more secure than a password? I've currently not setup SSH or anything else, really.
I followed a similar workflow, generating a new token (in github.com/settings/tokens), and using it as password without issues.
I just made sure:
its scope included repo, workflow, gist and user. (you can update those scopes without regenerating the token)
its expiration date was either not set, or set to a date far enough to allow me to test/use it.
The resulting token should start with ghp_
ghp_DUvWjre....(ghp_ followed by 36 alphanumerical chars)
The OP Tommy Tang confirms in the comments:
I didn't find a previous credential, so I just added a generic credential on the manager, and it works.
https://mycyberuniverse.com/how-fix-fatal-authentication-failed-for-https-github-com.html
After generating a new Personal Access Token, under 'Select Scopes', click on 'repo', then hit 'Generate new token'. This will give you a token which can be used to push code from the command line.
Post LinkedIn changes (around May 2015) have disabled our use of the share feature, via API call using the URL http://api.linkedin.com/v1/people/~/shares?format=json. We are now receiving a "403 authorization failed".
Steps taken to rehabilitate our share function:
Confirmed that ClientId & Client Secret keys are still the same as being used in our app
The Default Application Permissions have been confirmed, w_share is selected...which used to be rw_share (no longer available). Other selections made are r_basicprofile, r_emailaddress, & rw_company_admin...which are seemingly not related.
Authorized Redirect URLs are still applied for the domain we are using our application under.
Content type has been set to "application/xml", as suggested by other postings.
We have tried for months...hoping that any post changes to LinkedIn would have resolved our problem, yet nothing we have researched has helped. We figure that this might be a glitch from the permission modification update done by LinkedIn...since our code has never change, yet has worked for 2+ years prior to the May 2015 changes.
We would appreciate any insight as to what is going on here....as we are continuing to have this problem.
I found the problem, it was because the security of Linkedin changed. We had to had to alter the statement:
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Ssl3;
to this:
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls;
If you are relying on the "default application permissions", you may also want to double check that your OAuth code is not still requesting the old (no longer available) member permissions (e.g. rw_nus) via the ?scope= URL parameter, which will trump the "default application permissions" settings you've defined in your LinkedIn app's config.
Otherwise, the w_share permission should still be providing you the ability to post a share to LinkedIn.
I've been trying to use Google's OAuth for authentication on a Catalyst app. I've tried using CatalystX::OAuth2 and Catalyst::Authentication::Credential::OAuth but it seems I get stuck on configuration.
I'd like to get it working on Google and then proceed to Facebook
Any good advice out there? I've googled to death, but there doesn't seem to be a lot out there.
I realise this question is almost 2 years old but just in case it helps anyone else, here is some information obtained from a couple of weeks of testing and debugging. I've also published a test oauth2 client project using CatalystX::OAuth2 at https://github.com/simonamor/oauth2-client - it sort of works with Google although I've not done anything with the token yet such as fetching user profile information and the 'protected' page is broken currently. It might be enough to point you in the right direction though.
There seemed to be a problem with CatalystX::OAuth2 in that it didn't send a scope value, nor could I find a way to make it send one and yet Google's API requires one. Not all providers have this requirement so work ok. Having made a slight alteration to a local copy of CatalystX::OAuth2, I managed to get it to authenticate via Google. The (minor) changes are in a fork of this module, also in my github account.
Visit the Google developers console and create the OAuth2 credentials to use. You'll need them below.
To my oauth2client.yml (from the github project referenced above) I added the following:
Plugin::Authentication:
default:
credential:
grant_uri: [provided by google, ends]/o/oauth2/v2/auth
token_uri: [provided by google, ends]/oauth2/v4/token
client_id: [issued by google]
client_secret: [issued by google]
scope: [provided by google, ends]/auth/userinfo.profile
I don't have a reputation high enough to post more than two links so apologies for missing out parts of the urls above!
This was the only real configuration I needed to setup. By modifying the credential settings I've also used it successfully with dropbox.com as well.
I'm still working on the OAuth2 server side of things and those are the default config within the project which is why you need to add an extra section for Google.
if you provided some info, like where you are stuck and why, I might be able to help.
The cpan has an example config. If you are not using a config file, you can also add it in your Catalyst app, though I would recommend using a config file, there just paste in the example with the data you need specifically.
I'm trying to implement SSO using Atlassian Crowd, and there's a surprising lack of good documentation or even examples out there.
So far, I authenticate a user using CrowdClient.authenticateSSOUser, and get back a SSO Token (String) if successful. Then, I take this token and stuff it in the cookies myself (via HttpServletResponse). On subsequent page visits, I grab all the cookies, search for this one, and then call the CrowdClient.validateSSOAuthentication method on it.
My question is this: Am I supposed to be using more Crowd code for SSO? I seem to be doing more manually than I'd expect.
...I DO see hints of other possibilities out there... For example:
In crowd.properties, you can specify a crowd.token_key, which is apparently what name the app should use store the token in a cookie (though setting this value doesn't magically make that happen).
Things like the CrowdHttpTokenHelper exist in the latest version - yet seem to have no easily-found related examples (or documentation other than JavaDoc).
Yes, there are possibilities out there that will hopefully help or at least serve as reference.
For a readily available implementation, you might want to look into Integrating Crowd with Spring Security.
If you need finer control, use a CrowdHttpAuthenticator. It will allow you to authenticate a request with a username and password as well as check if a session has an existing session cookie. (Its concrete implementation will accept properties and uses crowd.token_key.)
CrowdClient is available if these don't fit your needs, but it's not the only option.
I've been looking all over to find the correct API call to block applications via application ID, however I've yet to find it. I'm actually becoming quite certain that it's not possible (for obvious reasons, Facebook revenue being one of them), however I was wondering if anyone knew of a way, even via URL call ('https://www.facebook.com/apps/block.php?id=' + APPID + '&action=block' no longer works correctly, if it ever did.)
Basically I've been making a ruby script to be deployed to help users block spammy and generally unwanted applications via application ID's, the script is almost complete, however I need a method to be able to actually block the applications! If anyone could give me some help, I'd very much appreciate it.
Refer to https://developers.facebook.com/docs/reference/api/application/#banned
Create/Ban
You can ban a user for an app by issuing an HTTP POST request to
APP_ID/banned?uid=USER_ID1,USER_ID2 with an application access token
(i.e. a token created using the app secret, not an application Page
access token as described above). You can specify the following
parameters.
This is not (and probably/hopefully will not ever) possible via API. There are too many reasons to leave it that way. You don't want applications block each other...
This may sounds like a show-stopper for you, but it's not! Generate report arguing the reason why some applications better be blocked/removed/reported and show it to users instructing 'em how to do this.