If you’re anything like me your clients won’t want a standard Facebook likebox plugin, they’ll want it all styled and customised their own way. You don’t need to spend all day going round the official documentation wondering if any of it applies to you for something simple like this, it’s quite easy. The confusion arises … Read more
Read this: http://www.quora.com/OAuth-2-0/How-does-OAuth-2-0-work or an even simpler but quick explanation: http://agileanswer.blogspot.se/2012/08/oauth-20-for-my-ninth-grader.html The redirect URI is the callback entry point of the app. Think about how OAuth for Facebook works – after end user accepts permissions, “something” has to be called by Facebook to get back to the app, and that “something” is the redirect URI. … Read more
Answer: There was a discussion about this on a bug reported on Google’s Issue Tracker – this has become disallowed due to security concerns. There is, therefore, no current way to use an Apps Script Web App as a JavaScript origin at all. More Information: The bug report in question: Fail to Add *.googleusercontent.com into … Read more
When you use the Authorization code grant (OAuth2 for backend apps – &response_type=code), you must redirect the browser to the /auth endpoint – you cannot use XHR for that. The user will be redirected back after authentication. After redirecting to the /auth endpoint, user needs to see in an address bar that the page is … Read more
Yes, OpenID Connect supports all OAuth 2.0 grant types including Resource Owner Password Credentials Grant and Client Credentials Grant. As we know, Authorization Code Grant and Implicit Grant are typical 3-legged flows including interaction between a client, an authorization server and a user. While the Resource Owner Password Credential Grant and Client Credential Grant are … Read more
Well, I finally figured it out. Not sure if I misread the documentation or if there are missing links, but anyway. Fact is that when you sign a APK and then ask Google for a OAuth2 token, you have to register your signed app through the dev console. It’s a security measure based on the … Read more
Seems like best thing to do is to just always have userId=”me” in your requests. That tells the API to just use the authenticated user’s mailbox–no need to rely on email addresses.
Posting my ultimate approach for posterity. As Tratcher pointed out, the AddGoogle middleware is not actually for a JWT authentication flow. After doing more research, I realized that what I ultimately wanted is what is described here: https://developers.google.com/identity/sign-in/web/backend-auth So my next problems were I could not rely on the standard dotnet core Jwt auth middleware … Read more
For anyone who is as stuck and frustrated as I was, I’ve left a detailed blog post on the entire process (with pictures and ranty commentary!). Click the link if you want that: http://www.calvinfroedge.com/salesforce-how-to-generate-api-credentials/ Here is a text only answer: Step 1: Create an account. You can create a (free) developer account at developer.salesforce.com Step … Read more
Here are my thoughts: The purpose of auth code + token in authorization code flow is that token and client secret will never be exposed to resource owner because they travel server-to-server. On the other side, implicit grant flow is for clients that are implemented entirely using javascript and are running in resource owner’s browser. … Read more