0

I am using a fiware-idm image in a docker container (https://hub.docker.com/r/fiware/idm/) and I'm trying access the SCIM API. There is user "idm" (default user), he's provider and has all permissions. But when I try get all users:

private String getAccessToken() {
    HttpServletRequest httpServletRequest = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
    HttpSession session = httpServletRequest.getSession();
    String accessToken = (String) session.getAttribute("access_token");
    return accessToken;
}

public void getUsers() throws IOException {
    String accessToken = getAccessToken(); 

    Client client = ClientBuilder.newClient();
    Response response = client.target("http://192.168.99.100:5000/v3/projects")
      .request(MediaType.TEXT_PLAIN_TYPE)
      .header("X-Auth-token", accessToken)
      .get();

    setResultUsersList("-- status: " + response.getStatus() + " <br>" 
            + "-- headers: " + response.getHeaders() + " <br>"
            + "-- body: " + response.readEntity(String.class) + " <br>"
            + "-- token: " + accessToken);
}

I receive an error msg: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}

But the authentication works and get the user infos too:

public void authenticateUser() throws OAuthSystemException, IOException {
    HttpServletResponse httpServletResponse = (HttpServletResponse) FacesContext.getCurrentInstance().getExternalContext().getResponse();

    OAuthClientRequest codeRequest = OAuthClientRequest
            .authorizationLocation("http://192.168.99.100:8000/oauth2/authorize")
            .setParameter("response_type", "code")
            .setClientId(CLIENT_ID)
            .setRedirectURI("http://localhost:8080/Example-Application-Security-UI/auth")
            .buildQueryMessage();

    httpServletResponse.sendRedirect(codeRequest.getLocationUri());
}

public void requestUserInfo() {
    HttpServletRequest httpServletRequest = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
    HttpSession session = httpServletRequest.getSession();
    accessToken = (String) session.getAttribute("access_token");

    String strJson = callWebservice("http://192.168.99.100:8000/user?access_token=" + accessToken);
    JSONObject jsonObject = new JSONObject(strJson);
    resultUserInfo = jsonObject.toString();
}

1 Answer 1

0

The X-Auth-Token header needed when making requests to Keystone requires a Keystone token as value, instead of the OAuth2 access token that you are currently providing.

You can obtain a Keystone token by means of a POST request to the authentication endpoint. Since one of the supported authentication methods in Keystone is OAuth2, you can even use the access token you obtained from the OAuth2 authentication to obtain a Keystone token:

POST  /v3/auth/tokens
body:

 "auth": {
        "identity": {  
            "methods": [
                "oauth2"
            ],
            "oauth2": {
                'access_token_id': access_token
            }
        }
    }

You may now use the Keystone token to perform requests to the SCIM API (or to any API endpoint to which the authenticated user has permissions).

Hope this helps for you!

Please note that the request to obtain the user information works since it is being performed to an endpoint in Horizon, rather than to a Keystone endpoint.

2
  • Thank you! It's working, I was making the request with body: Oct 21, 2016 at 17:34
  • **with body: ...."methods": ["password"]..., but now It's better using oauth2. Thanks! Oct 21, 2016 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.