3 ms·

So this can remove the need to use a web browser for authentication of Google API calls?

• vladvasiliu 4y ago
  Depending on the type of flow, probably not: > Note: To make browser flows work add http://localhost:9876/callback http://localhost:9876/callback as a redirect URL to your client.
  • mbilski 4y ago
    redirect url is required only for authorization code, implicit and hybrid grant flows
  • kohlerm 4y ago
    How do I do that?
    • mbilski 4y ago
      Depends on your oauth provider. If you wish to use the examples from the readme you do not need to anything - they work out of the box
    • JamesSwift 4y ago
      Usually its a 2 part process of 1) whitelisting the callback url in the oauth settings of the provider and 2) passing that whitelisted callback url in the auth flows
    • superkuh 4y ago
      Unfortunately Oauth 2.0 is not a standard. It's a toolkit for making standards and pretty much every sufficiently large corporation is going to implement their own unique form. There is no one size fits all solution.
      • tnzk 4y ago
        I assume you meant it is not a protocol, which surely is stated in oauth.net [1]. Still it is a pretty much a standard though. [1]: https://oauth.net/articles/authentication/ https://oauth.net/articles/authentication/
• mobilio 4y ago
  Try oacurl.jar
  • shrx 4y ago
    This seems to require a web browser at least for the initial setup.
    • mobilio 4y ago
      Actually you can skip it with --no-browser from command line
• tzahifadida 4y ago
  Specifically for OAuth2 the authentication part for flows that requires redirect, is on the shoulders of the authentication platform. There is no specific API that says how to do it. I can use my user/password to do the login. This is why you have to use a browser if that platform require you to enter the credentials in the browser. Up to that login and from that login, everything is governed by oauth2. An alternative system, might open the authentication phase in a mobile app or a biometric input, etc... The application at the end of the url will be deciding how to do that. The reason for the whole thing is that we want to separate the area in which needs protection (authorization) and the area which does the authentication and can sit at a trusted site and may supply services to several resource servers. You can play with such an implementation with an open source keycloak server. It really clearly reveals how the whole thing works.