Client Type:
confidential
and Authorization grant type: authorization codehttp://www.example.com/authorization/
https://gymkhana.iitb.ac.in/profiles/oauth/authorize/?client_id=YOUR_CLIENT_ID&response_type=code&scope=basic&redirect_uri=REDIRECT_URI&state=some_state
scope, redirect_uri and state are optional here.
state
can be anything, it will be returned back to you after authorization. You can use this to rememeber
your
client. redirect_uri should be from redirect uri you registered for app. If nothing is
provided
here then first redirect uri will be assumed to be default. From now onwards we'll call it
REDIRECT_URI. scope is a string of space separated scopes.
scope parameter then basic scope will be
assumed.
REDIRECT_URI?error=access_denied else
you'll get
REDIRECT_URL?state=some_state&code=AUTHORIZATION_CODE. AUTHORIZATION_CODE
will be
an alpha-numeric code
AUTHORIZATION_CODE after client has authorized itself.
AUTHORIZATION_CODE is short lived code. You need to redeem it quickly to get
access_token
https://gymkhana.iitb.ac.in/profiles/oauth/token/. You're HTTP request
will
look like
POST /profiles/oauth/token/ HTTP/1.1 Host: gymkhana.iitb.ac.in Authorization: Basic AUTHENTICATION_TOKEN Content-Type: application/x-www-form-urlencoded; charset=UTF-8 code=AUTHORIZATION_CODE&redirect_uri=REDIRECT_URI&grant_type=authorization_code
AUTHENTICATION_TOKEN is base64 of CLIENT_ID:CLIENT_SECRET.
Here code, redirect_uri and grant_type are compulsory
access_token and
refresh_token as json
{
"access_token" : "access_token",
"token_type" : "Bearer",
"expires_in" : "36000",
"refresh_token" : "refresh_token",
"scope" : "basic"
}
access_token and refresh_token are both alpha-numeric stringsaccess_token are short living tokens and will expire in 10 hours.
refresh_token
are
long living tokens and you should save them in your database for future purpose.scope is space separated list of scopes that client has granted to you. You should also
save
these scope in your database for reference purpose. access_token will expire quickly, you need to generate new access_token
with
refresh_token
refresh_token=REFRESH_TOKEN&grant_type=refresh_token
access_token and
refresh_token
both changed. You need to update your refresh_token in database
POST /profiles/oauth/revoke_token/ HTTP/1.1 Host: gymkhana.iitb.ac.in Content-Type: application/x-www-form-urlencoded; charset=UTF-8 token=TOKEN&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&token_type_hint=TOKEN_TYPEHere
TOKEN can be access_token or refresh_tokentoken_type_hint is optional. TOKEN_TYPE should be either
access_token or
refresh_token
basic section onceid only. You need to have basic
scope for
this
https://gymkhana.iitb.ac.in/profiles/user/api/user/?fields=RESOURCE_LIST. fields is optional
parameter
and by default it includes basic fields. RESOURCE_LIST is comma-separated
list of
user resources. You should include access_token in request header as
GET /profiles/user/api/user/ HTTP/1.1 Host: gymkhana.iitb.ac.in Authorization: Bearer ACCESS_TOKEN
https://gymkhana.iitb.ac.in/profiles/user/api/user/?fields=first_name,last_name,type,profile_picture,sex,username,email,program,contacts,insti_address,secondary_emails,mobile,roll_number
will look like (assuming you've enough scopes)
{
"id": 1,
"username": "username",
"first_name": "First Name",
"type": "TYPE",
"profile_picture": "/profiles//path/to/profile_picture_file"
"last_name": "Last Name",
"sex": "SEX",
"email": "username@iitb.ac.in",
"mobile": "0123456789",
"roll_number": "123456789",
"program": {
"id": 1,
"department": "DEPARTMENT",
"department_name": "FULL_DEPARTMENT_NAME",
"join_year": 2012,
"graduation_year": 2016,
"degree": "DEGREE",
"degree_name": "FULL_DEGREE_NAME"
},
"secondary_emails": [
{
"id": 1,
"email": "user_email@gmail.com"
}
],
"contacts": [
{
"id": 1,
"number": "9876543210"
}
],
"insti_address": {
"id": 1,
"room": "room_number",
"hostel": "HOSTEL",
"hostel_name": "FULL_HOSTEL_NAME",
}
}
Here you'll get only resources permitted by user in scope.
DEPARTMENT list:
DEPARTMENT_NAME: FULL_DEPARMENT_NAMEDEGREE list:
DEGREE: FULL_DEGREE_NAMEHOSTEL list:
HOSTEL: FULL_HOSTEL_NAMESEX list:
TYPE list:
send_mail permission from user for this to work
POST /profiles/user/api/user/send_mail/ HTTP/1.1
Host: gymkhana.iitb.ac.in
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json
{
"subject": "Hello World",
"message": "Lorem Ipsum",
"reply_to": [
"email_address_1@example.com",
"email_address_2@exapple.com"
]
}
{
"Message-ID": "<174456398492.185.10867357706385239599@sso.gymkhana.iitb.ac.in>",
"status": true
}
Message-ID is a unique identifier for each sent message. Its format is
<timestamp.pid.random_number@fqdn>. Message-ID in this example is
actually a valid generated identifier which is changing each time you open this page!status is either true or false depending on whether message was
sent successfully. Remember status: true doesn't guarantee delivery of message
Sent via SSO by <APPLICATION_NAME> You received this message because you've provided the email sending permission to the application
reply_to is list of email address where you want your user to reply. Most of
the mail
servers honor this protocol and by clicking on "reply" will directly reply to these emails.
Message-ID, failure state,
application
and user for each email. This is stored for debugging and performance improvement purposes
basic section once<script src="https://gymkhana.iitb.ac.in/profiles/static/widget/js/login.min.js"
type="application/javascript"></script>
in your html file
<div id="sso-root"></div> in your html where you want to keep your
login button
<script type="application/javascript">
new SSO_JS({
config: {
client_id: 'your-long-client-id', // Compulsory
scope: ['basic', 'profile'], // Optional. Default is ['basic']
state: '', // Optional. Default None
response_type: 'code', // Optional. Default is 'code'
redirect_uri: 'uri-for-redirection', //Optional
sso_root: document.getElementById('sso-root'),
/* Optional
document.getElementById don't work if your element is not in light DOM. In that case you need to
provide selector here. In most of the cases this will work.
*/
},
colors: { // All Optional
button_div_bg_color: '303F9F', // Background color of button
button_anchor_color: 'FFFFFF', // Font color of Button
logout_anchor_color: '727272', // Font color of logout mark (The one with 'Login as other user'
},
}).init();
</script>
refresh_token and access_token on your server. They can be used for
background requests.
BijoySingh is maintaining a PHP library The documentation is present here
This repo has the source code for django library. The pypi release is present here
Python library is maintained here. This is currently in alpha version