Version 7.1 by messines on 2024/08/28 13:42
Show last authors
1 ==
2 Update your client to enable Device Flow ==
3
4 Not available through the UI yet, use the [[lab notebook>>https://lab.ch.ebrains.eu/hub/user-redirect/lab/tree/shared/Collaboratory%20Community%20Apps/Managing%20an%20OpenID%20Connect%20client%20-%20V2.ipynb]]
5
6 Add an attribute to the client JSON and update it
7
8
9 (% class="box" %)
10 (((
11 "attributes": {
12 "oauth2.device.authorization.grant.enabled": true
13 }
14 )))
15
16 == Request a code ==
17
18 {{code language="bash"}}
19 curl --location --request POST 'https://iam.ebrains.eu/auth/realms/hbp/protocol/openid-connect/auth/device' \
20 --header 'Content-Type: application/x-www-form-urlencoded' \
21 --data-urlencode 'client_id=yourClientId'
22 {{/code}}
23
24
25 Secret is not require for public client.
26 \\The API will answer with a link
27
28 {{code language="json"}}
29 {
30 "device_code":"0zQm[...]e5h5kUvNYx0",
31 "user_code":"IWBR-DDY",
32 "verification_uri":"https://iam.ebrains.eu/auth/realms/hbp/device",
33 "verification_uri_complete":"https://iam.ebrains.eu/auth/realms/hbp/device?user_code=IWBR-DDYK",
34 "expires_in":600,
35 "interval":5
36 }
37 {{/code}}
38
39 == Visit the link to validate your code ==
40
41 Here you just need to visit the link in verification_uri_complete to validate your login and consent
42
43 == Request your access token ==
44
45 Now you just need to request your access token, you need to enter the device_code provided in the first call above
46
47 {{code language="bash"}}
48 curl --location --request POST 'https://iam.ebrains.eu/auth/realms/hbp/protocol/openid-connect/token' \
49 --header 'Content-Type: application/x-www-form-urlencoded' \
50 --data-urlencode 'device_code=0zQm[...]e5h5kUvNYx0' \
51 --data-urlencode 'client_id=yourClientId' \
52 --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:device_code'
53 {{/code}}
54
55 == Generic Device Flow Info ==
56
57 More parameters in the official device flow configuration
58
59 https:~/~/auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow
60
61 {{info}}
62 In case of issue you can add the client secret, but the purpose of device flow is to be used with
63 ~-~-data-urlencode 'client_secret=yourClientId'
64 {{/info}}
65
66