Skip to content

OAUTH 2.0 Authentication

This page describes different OAuth2 Authentication setups, covering several prevalently used services. This page also attempts to show how to interpret the web pages describing the authentication.

  • Salesforce
    • Salesforce is a CRM/Cloud Application Platform.
  • Twitter
    • Short messaging service, used by Narcissists and shouty people.
  • Paypal
    • A payment gateway.

Salesforce

The salesforce API documentation: https://goo.gl/v365UT lists three supported authorisation workflows, Web server flow, User-agent flow and Username password flow.

As Both Web server and User-agent flows require a redirect URL (three legged) we will need to use the Username-password flow: https://goo.gl/Hvh8II

As is common to almost all two legged workflows; an application must first be registered with the resource owner (salesforce) so that it can generate client ids and secrets for use. https://goo.gl/3C5LgF

Once the client id and secret are known we can start setting up our OAuth settings in IMan.

The salesforce documentation describes the request:

Unfortunately the documentation neglects to mention how these parameters are to be passed; though a quick search through the documentation shows that Url-encoding is commonly being used.

The documentation also provides an example response:

{
  "id":"https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P",
  "issued_at":"1278448832702","instance_url":"https://na1.salesforce.com",
  "signature":"0CmxinZir53Yex7nE0TD+zMpvIWYGb/bdJh6XfOH6EQ=",
  "access_token":"00Dx0000000BV7z!AR8AQAxo9UfRcgKFmxOtvxjTrKW19ye6PE3Ds1eQz3z8jr3W7_VbWmEu4Q8TVGSTHxs"
}

We can see from the response that for a successful authorisation we require a request like this:

POST https://login.salesforce.com/services/oauth/token HTTP/1.1
Accept: application/json; charset=utf8
User-Agent: realsiable-iman-salesforce/v29.0
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
grant_type=password
client_id=[some client id]
client_secret=[some client_secret]
username=[some user_name]
password=[some password]

Configuring IMan to create an authorisation requests such as this is a straight forward and achieved via the IMan setup screen.

Lets have a look at the required request and where these options will map into the setup screen:

The token request settings:

client_id=%[client_id];client_secret=%[client_secret];grant_type=password;username=%[user_name];password=%[password]

Twitter

Twitter supports a number of OAuth authentication workflows, one of which is application only workflow: https://goo.gl/UNbKKx

As you can see the diagram on this workflow matches the implicit grant (two legged) description above:

An example token request for twitter is shown below:

POST http://api.twitter.com/oauth2/token HTTP/1.1
Authorization: Basic eHZ6MWV2RlM0d0VFUFRHRUZQSEJvZzpMOHFMdzhpRUo4OERSZHlPZw==
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
grant_type=client_credentials

Configuring a token request in IMan

IMan Setup

Paypal

The setup was exclusively derived from the API documentation.

https://developer.paypal.com/docs/api/get-an-access-token-curl/

We recommend creating a sandbox account first.

The Client ID is the Client ID from the App Setup; the Client Secret is the Secret.

IMan Setup