LinkedIn
Twitter
1 ACCEPTED SOLUTION
I have a couple things for you.
You wrote
However the sample api provided --> (https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/outbound-oauth) does not implement multiple callbacks URL's.
Yes. Correct. In fact there's no callback URL at all in that sample. That sample shows you how you might use Apigee to manage OAuth tokens for use with the outbound (southbound?) request. In that example, Apigee is not issuing or verifying a token. Apigee is requesting a token from a Microsoft endpoint, for the translator service. But that's a client-credentials grant. There's no redirectURI at all. What I am saying is, the example you cited is completely unrelated to the question you are asking. No judgment; the topic of Oauth is complicated, and it's not easy to find the right sample from Apigee. I feel your pain.
Could you please provide valid sample api proxy for oAuth2 which implements multiple callback url's?
I think you are asking for an Apigee API proxy that dispenses OAuth tokens, and which supports multiple redirect URIs. Is that right? Before we get to the answer, let us first clarify: the callback URI, or let's call it the official name, the redirect URI, is used only with authorization code grant types*. (* Not quite true. The redirect_uri is also used with Implicit grant types, but you shouldn't be using implicit grant. So we will ignore implicit grant. ) See section 4.1.1 in RFC 6749. So that means what you are asking for is an Apigee API proxy that dispenses OAuth tokens via authorization code grant type, and which supports multiple redirect URIs.
OK, if that's what you want, then I have good news for you!
Any Apigee proxy that dispenses OAuth tokens via authorization code grant type, supports multiple redirect URIs. I think the documentation page you cited is in error, years out of date. And I filed a documentation defect to get it fixed (internal reference b/208920482). It actually works. There is no special logic or configuration you must include in the OAuth token-dispensing proxy to handle multiple redirect URIs. But, take note: OAuthV2 does not support using multiple redirect URIs in the request-for-token. (Neither in the /authorize call, nor in the /token call). "Support for multiple redirect URIs" means you can configure your client in Apigee to have a list of possible redirect URIs. It's an attribute on the client app. The Administrative UI has a label that suggests you can specify just one URI. It doesn't give any indication that multiple URIs are supported. But that's not so. Though the client app supports multiple redirect URIs, the /authorize request should always carry exactly one redirect_uri.
When you specify the redirect URIs as a comma-separated list in the attribute on the client, then at runtime, the OAuthV2 policy (specifically Operation=GenerateAuthorizationCode) will do the right thing. I do not know if spaces are allowed between the multiple redirect URIs on the client attribute. If it's important to you, try it and see.
When the client sends the /authorize request, it should pass exactly ONE of the redirect URIs that is specified on the client app. If it does, then the Apigee OAuthV2 policy will allow it. If the client passes zero redirect_uri parameters, or more than one redirect_uri parameter, or if the one redirect_uri parameter does not exactly match any of the (potentially multiple) redirect URIs listed for the client app in the Apigee metadata, then the Apigee policy will reject the /authorize call as invalid.
Does this make sense?
If you need an example of a proxy that dispenses tokens via authorization code grant, there are multiple examples out there. Here is one I can recommend. To test it with multiple redirect URIs, just configure the client to have more than one. Then invoke the /authorize endpoint multiple different times, each time with a single, unique redirect_uri. You'll see that it works as I described above.
I have a couple things for you.
You wrote
However the sample api provided --> (https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/outbound-oauth) does not implement multiple callbacks URL's.
Yes. Correct. In fact there's no callback URL at all in that sample. That sample shows you how you might use Apigee to manage OAuth tokens for use with the outbound (southbound?) request. In that example, Apigee is not issuing or verifying a token. Apigee is requesting a token from a Microsoft endpoint, for the translator service. But that's a client-credentials grant. There's no redirectURI at all. What I am saying is, the example you cited is completely unrelated to the question you are asking. No judgment; the topic of Oauth is complicated, and it's not easy to find the right sample from Apigee. I feel your pain.
Could you please provide valid sample api proxy for oAuth2 which implements multiple callback url's?
I think you are asking for an Apigee API proxy that dispenses OAuth tokens, and which supports multiple redirect URIs. Is that right? Before we get to the answer, let us first clarify: the callback URI, or let's call it the official name, the redirect URI, is used only with authorization code grant types*. (* Not quite true. The redirect_uri is also used with Implicit grant types, but you shouldn't be using implicit grant. So we will ignore implicit grant. ) See section 4.1.1 in RFC 6749. So that means what you are asking for is an Apigee API proxy that dispenses OAuth tokens via authorization code grant type, and which supports multiple redirect URIs.
OK, if that's what you want, then I have good news for you!
Any Apigee proxy that dispenses OAuth tokens via authorization code grant type, supports multiple redirect URIs. I think the documentation page you cited is in error, years out of date. And I filed a documentation defect to get it fixed (internal reference b/208920482). It actually works. There is no special logic or configuration you must include in the OAuth token-dispensing proxy to handle multiple redirect URIs. But, take note: OAuthV2 does not support using multiple redirect URIs in the request-for-token. (Neither in the /authorize call, nor in the /token call). "Support for multiple redirect URIs" means you can configure your client in Apigee to have a list of possible redirect URIs. It's an attribute on the client app. The Administrative UI has a label that suggests you can specify just one URI. It doesn't give any indication that multiple URIs are supported. But that's not so. Though the client app supports multiple redirect URIs, the /authorize request should always carry exactly one redirect_uri.
When you specify the redirect URIs as a comma-separated list in the attribute on the client, then at runtime, the OAuthV2 policy (specifically Operation=GenerateAuthorizationCode) will do the right thing. I do not know if spaces are allowed between the multiple redirect URIs on the client attribute. If it's important to you, try it and see.
When the client sends the /authorize request, it should pass exactly ONE of the redirect URIs that is specified on the client app. If it does, then the Apigee OAuthV2 policy will allow it. If the client passes zero redirect_uri parameters, or more than one redirect_uri parameter, or if the one redirect_uri parameter does not exactly match any of the (potentially multiple) redirect URIs listed for the client app in the Apigee metadata, then the Apigee policy will reject the /authorize call as invalid.
Does this make sense?
If you need an example of a proxy that dispenses tokens via authorization code grant, there are multiple examples out there. Here is one I can recommend. To test it with multiple redirect URIs, just configure the client to have more than one. Then invoke the /authorize endpoint multiple different times, each time with a single, unique redirect_uri. You'll see that it works as I described above.
