Overview

This page describes a fast example of security integration in a 3rd-party service.
The example is based on the current state of the regression environment.

Nutrition OAuth 2.0 Provider is authorization provider for Nutrition Mulesoft APIs. It is dedicated for Machine To Machine (M2M) integrations.

Required precondition:

• Mulesoft applications created in Reckitt Anypoint Exchange:
  • one for non-prod environment
  • second for production

To achieve this precondition, either way is the proper way 'on request' / 'self service':

On request:

If you don't have access to Reckitt Exchange, please submit your request here: → TODO proces

Self service:

If you already have access to Reckitt Exchange please follow these steps:

Proper authorization:

The steps are:

1. get access code (require having created user in CDP team authorization service - look above REQUIRED PRECONDITION)
2. use access code to consume a service.

Get access code

To do that need to send a proper request according to below specification:

Method: POST

Endpoint: http://digital-security-authservice-regression.frankfurt.rbdigitalcloud.com/oauth/authorize

URI Params:

• In the URI should be the following set of request parameters:
• ?response_type=code&client_id=vx-web-test&scope=SAVE_DATA&redirect_uri=http%3A%2F%2Fwww.rb.com%2F&state=rbclientid_rtsdek1i51xcv5058935 

  where:

 green is 3-party client_Id

orange is the state, in the form: Client_Id + "_"+  randomly generated, min lenght: 10, max length=15 (above example has Client_Id= rbclientid and randomly generated part = rtsdek1i51xcv5058935)

Headers:

• cache-control: no-cache
• content-type: application/x-www-form-urlencoded
• authorization: Basic cmVja2l0dGJlbmNraXNlcjp0OHVMa1pNV05hODdteHpLb2tLQ1hWUTlQRWt3elhKdjlZckhSRDdyNjNXSndoNWRqZg== (always the same)
  

In the success scenario the REST request returns 302 status and the "Location" header as follows: 

Location: http://www.rb.com/?code=d1c82ed4-da4a-4675-81e7-5f9b0e295568&state=vx-web-test1515058935The access code should be extracted from the "code" request parameter:

d1c82ed4-da4a-4675-81e7-5f9b0e295568

REMARKS:

1. The vx-web-test client_id and the set of roles "SAVE_DATA READ_DATA MANAGE_BUCKET MANAGE_SCHEMA DATA_EXPORT READ_SCHEMA" is predefined. Usually for each 3rd-party tool our security managers create separate client_id with necessary set of roles.
   
2. The "state" request parameter should be unique for each attempt to issue access code.
3. The header value passed in the "authorization" is constant per each environment (the one we use in this example is specific to regression environment).
4. Some programs like "Postman" try follow redirects after they receive 302 HTTP status in response. In this case please turn off this default setting in the Postman global settings.
   "curl" - a command line tool which does not follow redirects by default, but please use "-v" key in order to see the detailed HTTP response in the terminal window.
5. The access codes have relatively short lifetime. For example on regression environment it is only 15 seconds available in order to get the access token.
6. You need to disallow your request for redirecting 

Get access token

To do that need to send a proper request according to below specification:

Method: POST

Endpoint: http://digital-security-authservice-regression.frankfurt.rbdigitalcloud.com/oauth/token

URI params:

• In the URI should be the following set of request parameters:
• grant_type=authorization_code&redirect_uri=http%3A%2F%2Fwww.rb.com%2F&client_id=vx-web-test&client_secret=Abc1$345&code=d1c82ed4-da4a-4675-81e7-5f9b0e295568&state=vbu3artsdek1i51xcv5058935 

where:

green is 3-party client_Id

blue is code from the first request

orange is the state - the same as in the first request

red is the client_secret - generated as a required precondition

Headers:

• cache-control: no-cache
• content-type: application/x-www-form-urlencoded
• authorization: Basic dngtd2ViLXRlc3Q6QWJjMSQzNDU=

In the success scenario the request returns 200 status with the following JSON structure in the response body:

{"access_token":"cacd5cda-08f8-47fa-8431-82d7a82184a6","token_type":"bearer","refresh_token":"92c437ba-e6ac-4ae2-84ce-ec7338b506b6","expires_in":60}

After that need to extract "access_token" from the above JSON in order to get the access token:

cacd5cda-08f8-47fa-8431-82d7a82184a6

REMARKS:

1. The access code that was retrieved in the previous step is passed in the "code" request parameter on this step;
2. The value that is passed in the "authorization" header is base64 encoded string for "vx-web-test:Abc1$345";
3. The vx-web-test is the client_id and the Abc1$345 is the password for vx-web-test client_id.
4. You need to disallow your request for redirecting