(Security) Gestión de tokens en autenticación Oauth2

onesait Platform is ready to work with OAuth2 authentication. Following we'll see the Oauth2 Token management flow.

1. Oauth2 Realm configuration parameters

When creating or Updating a Realm, there are two parameters to be configured associated to the Oauth Tokens:

• KEY (Secret): key that will be used for clients's authentication..
• TOKEN VALIDITY TIME (S): configurable duration (in seconds) in which the generated token will be valid.

They are non-obligatory attributes. In case of not informing them, they will take default values ​​(onesaitplatform and 43200 (12 hours)).

2. Token Generation

There is an endpoint that allows Oauth2 token generation. The URL is:

https://www.onesaitplatform.online/oauth-server/oauth/token

It's a POST request, and it must include:

• Headers:
  • Authorization: (client:secret b64)
  • Content-Type: application/x-www-form-urlencoded
• Body:
  • grant_type: password (User/Password request)
  • username: user's Id
  • password: user's password
  • clientId: client's Id for Token use
  • scope: Token scope 

Using Postman to send this request, it will be something like this:

The response will be like this:

To Highlight:

• access_token: Access token
• refresh_token: Refresh Token (one use)
• expires_in: Remaining validity time (seconds)
• authorities: Realms' roles asigned to the user
  

3. Chek Token

Service that verifies the validity of a token. The endpoint will be:

https://www.onesaitplatform.online/oauth-server/oauth/check_token

The request must include:

• Headers:
  • Authorization: (client:secret b64)
• Parameter:
  • token: token to validate

Using postman:

If the token is valid, a response will be obtained in the form:

To Highlight:

• exp: Expiration date
• client_id: client for which the token was generated
• authorities: Realm's Roles to which the token's user belongs

4. Refresh Token

Service that regenerates the token in order to obtain another one. The endpoint is:

https://www.onesaitplatform.online/oauth-server/oauth/token

(the same as for getting a new token, changes the grant-tpe).

The request must include:

• Headers:
  • Authorization: (client:secret b64)
  • Content-Type: application/x-www-form-urlencoded
• Body:
  • grant_type: refresh_token (for token refresh)
  • refresh_token: refresh token obtained when generating the token)

Using Postman:

The result is the same as for a get token request:

The refresh token is one-use token. After regenerating the token, a new refresh token will be provided.

5. Revoke Token

As an addional service, a revoke token service has been included. It allows to disable (revoke) an existing access token associated to an user.

The endpoint is:

https://www.onesaitplatform.online/oauth-server/openplatform-oauth/revoke_token

The request must include:

Headers:

• Authorization: (cliente:secret en b64)
• Content-Type: application/x-www-form-urlencoded

Query Param:

• token: (token to revoke)

In Postman:

The result will indicate that the token is not longer valid: