I'm new to this Azure/Office365 workflow. I'm working with office365 mailbox but I have a problem with refresh token process. I can get access token and refresh token with clientID and clientSecret process but when I try to use refresh token to obtain access token it always return as error.
I follow this link as guideline for my code.
$CLIENT_ID="....";
$CLIENT_SECRET="...";
$TENANT="...";
$REFRESH_TOKEN="...";
$url= "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token";
$param_post_curl = [
'client_id'=>$CLIENT_ID,
'client_secret'=>$CLIENT_SECRET,
'refresh_token'=>$REFRESH_TOKEN,
'grant_type'=>'refresh_token' ];
$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($param_post_curl));
curl_setopt($ch,CURLOPT_POST, 1);
curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
$oResult=curl_exec($ch);
My code look something like this and it always return
"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID '7xxx...'
Thanks in advance for your help.
Related
Currently I am trying to get reviews from https://play.google.com/store/apps/details?id=com.rosterelf.android.phone&hl=en by following https://developers.google.com/android-publisher/api-ref/rest/v3/reviews/list documentation.
I am using the PHP (cURL) method but I am keep getting an error saying --- Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.
Below are my steps what I have done / tried so far.
Created one Api KEY, OAuth 2.0 Client ID and Service Account in Google Developer Console.
Enabled the Google Play Android Developer API and Google Play Custom App Publishing API too.
Going at my browser https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/androidpublisher&response_type=code&redirect_uri=REDIRECT-URI&client_id=CLIENT-ID
It gives me the code in response and then to be able to get access_token, I am using below PHP cURL code which is also working fine.
<?php
$client_id = 'CLIENT-ID';
$redirect_uri = 'REDIRECT-URL';
$client_secret = 'CLIENT-SECRET';
$code = 'CODE';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://accounts.google.com/o/oauth2/token");
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
'code' => $code,
'client_id' => $client_id,
'client_secret' => $client_secret,
'redirect_uri' => $redirect_uri,
'grant_type' => 'authorization_code'
));
$data = curl_exec($ch);
var_dump($data);
exit;
And in response, I am successfully able to get the access_token.
Now I am trying to go directly to this page in browser https://www.googleapis.com/androidpublisher/v3/applications/com.rosterelf.android.phone/reviews?access_token=ACCESS-TOKEN but it keeps saying me...
Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project
-> I have checked the roles and permissions and it has owner as a permission in service account.
-> My REDIRECT-URI also the same URL throughout this process.
I event tried this URL to fetch the reviews https://androidpublisher.googleapis.com/androidpublisher/v3/applications/com.rosterelf.android.phone/reviews/review?access_token=ACCESS-TOKEN but having the same error.
Can someone please guide me what am I missing from here and why I am getting here and what exactly I should do from here on to get the reviews ?
Any help or suggestions will be highly appreciated.
Thanks in advance.
This is an example for that API using the official client library. I believe this code is for service account authentication. The service account will need to be properly configured see using_a_service_account How to create service account credetinals just remember to enable the proper library.
<?php
require_once 'google-api-php-client-2.2.2\vendor\autoload.php';
putenv('GOOGLE_APPLICATION_CREDENTIALS=client_secret.json');
$client = new Google_Client();
$client->useApplicationDefaultCredentials();
$client->addScope(Google_Service_AndroidPublisher::ANDROIDPUBLISHER);
$android_publisher = new Google_Service_AndroidPublisher($client);
$response = $android_publisher->reviews->listReviews('appname');
echo "<pre>";
var_dump($response);
I am learning to build a Login via Google button on my Joomla website, and I am following instruction on https://developers.google.com/identity/protocols/oauth2/web-server.
A little background:
I am using a third party extension to handle social login. Its facebook login works well, but its google login is outdated, still trying to connect to Google Plus endpoints. Clicking the login button on my page does lead to Google's account choice screen, after I choose an account and grant permission, there is a simple error message on the callback page. The author has stopped updating the extension, so for learning purpose, I've decided to fix it myself.
What I've achieved:
Currently I was able to get the access token from Google.
.......
$postdata = array(
'grant_type' =>'authorization_code',
'client_id' => $this->params->get('goappid'),
'client_secret' => $this->params->get('gosecret'),
'redirect_uri' => $this->getRedirectURL().'&task=gologin',
'code' => $_GET['code']);
curl_setopt($curl, CURLOPT_URL, 'https://oauth2.googleapis.com/token');
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-type: application/x-www-form-urlencoded'));
curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($postdata));
$oauth = json_decode(curl_exec($curl));
// Above code seems to be fine, getting $oauth response as follows
// "access_token": "token string",
// "expires_in": 3599,
// "scope": "https://www.googleapis.com/auth/userinfo.profile",
// "token_type": "Bearer",
// "id_token":"token string"
if (isset($oauth->access_token)) {
curl_setopt($curl, CURLOPT_POST, false);
curl_setopt($curl, CURLOPT_URL, 'https://www.googleapis.com/plus/v1/people/me?access_token='.$oauth->access_token); //Apparently outdated endpoint
$user = json_decode(curl_exec($curl));
if (empty($user->error)) {
curl_setopt($curl, CURLOPT_URL, 'https://www.googleapis.com/plus/v1/people/me/activities/public?access_token='.$oauth->access_token);//Apparently outdated endpoint
My question: At this point, I don't know what to do. The instruction says After your application obtains an access token, you can use the token to make calls to a Google API on behalf of a given user account, but how do I "make calls to a Google API"? To make a simple login via Google button, which API should I call? And to what endpoint should I make the request? I can't find this information from the instruction page. Above code is making request to https://www.googleapis.com/plus/v1/people/me?access_token, which is obviously outdated but how should I change this? This should have been provided by the instruction but I couldn't find it. And if I want to access other Google APIs, how do I "make calls" to them? a.k.a where do I find endpoints for each API?
I've also read https://developers.google.com/identity/protocols/oauth2/openid-connect, is what I am trying to do considered OIDC? Should I proceed according to this document?
I still think that access_token in the query path works in some Google apis. until June 2021
GET https://www.googleapis.com/plus/v1/people/me?access_token=[token]
I recommend switching to using an authorization header
GET https://people.googleapis.com/v1/%5BRESOURCENAME%5D HTTP/1.1
Authorization: Bearer [YOUR_ACCESS_TOKEN]
Accept: application/json
Main Aim: To get access_token so I may display my Instagram feed on the website.
Currently, to get an access token, we go to this url and click on Authorize to get the code, further exchanged for access_token.
https://api.instagram.com/oauth/authorize
?client_id={app-id}
&redirect_uri={redirect-uri}
&scope=user_profile,user_media
&response_type=code
Now, if I am writing a PHP-curl script to send this access_token and get my posts, how will I get an access token each time, I can not really click on authorize every time my API requests data, further, clicking authorize every 60 days is also not a long term solution for me.
So I was hoping if there was a way ( that I could call this URL, and get authorization code directly? )
So far my script:
$authURL = "https://api.instagram.com/oauth/authorize
?client_id=$client_id
&redirect_uri=$redirect_uri
&scope=user_profile,user_media
&response_type=code";
//STEP 1, GET THE AUTHORIZATION CODE (i am stuck here, how to get code from only PHP,
//without external clicks..)
//https://www.redirecturl.com?code=AQgw#_
$authorization_code = '48FduaX0g.....VZIj';
//STEP 2 GIVE THE CODE FOR TOKEN
$url = 'https://api.instagram.com/oauth/access_token';
$myjson = "
{'client_id': $client_id,
'client_secret': $client_secret,
'grant_type':'authorization_code',
'redirect_uri':$redirect_uri,
'code': $authorization_code
}";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_POSTFIELDS, $myjson);
$result = curl_exec($ch);
curl_close($ch);
$insta_details = json_decode($result);
echo $insta_details['access_token'];
curl -X GET \
'https://graph.instagram.com/17841405793187218/media?access_token=IGQVJ...'
The authorization step requires human interaction to login with a username / password. So there is no way to do that via only PHP.
But if you just need to display a feed on a website using PHP, you can use this package: https://packagist.org/packages/espresso-dev/instagram-basic-display-php
Grab the code in the callback after auth:
$code = $_GET['code'];
And then use this following methods:
getOAuthToken() to het the initial token
getLongLivedToken() to get the long-lived token valid for 60 days
Store the long-lived token so that can be used to retrieve the posts and just call the refreshToken() method every 50 days or so to refresh the token in the background and update the token you're using.
I am using Firebase Auth Rest API. I have code written in PHP to add the user to the database and firebase authentication. The information I store is kind, idToken, email, refreshToken, expiresIn, localId. It all works great!
Now when I am trying to delete the user from database it works fine but does not delete the user from the firebase authentication. Please find the code below for sign up and deleting the user.
The errors I get is either
CREDENTIALS_TOO_OLD_LOGIN_AGAIN (or)
INVALID_ID_TOKEN.
FIREBASE_KEY is my firebase key and in the $data I am passing the user idToken
/*
* User Sign Up
*/
function user_signup($data){
$response = true;
$data = json_encode($data);
$url = "https://www.googleapis.com/identitytoolkit/v3/relyingparty/signupNewUser?key=".FIREBASE_KEY;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$jsonResponse = curl_exec($ch);
if(curl_errno($ch))
{
$response = false;
}
curl_close($ch);
return $jsonResponse;
}
/*
* User Delete
*/
/* function user_delete($data){
$response = true;
$data = json_encode($data);
$url = "https://www.googleapis.com/identitytoolkit/v3/relyingparty/deleteAccount?key=".FIREBASE_KEY;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$jsonResponse = curl_exec($ch);
if(curl_errno($ch))
{
$response = false;
}
curl_close($ch);
return $jsonResponse;
} */
There are two ways to interact with the Firebase REST APIs:
By authenticating your requests with a user's ID token, with the same permissions and limitations as if they would interact with your application on their own
By authenticating with the credentials of a Service Account, which gives you full access to your application, without any limitations.
To delete a user, you can use both methods, but when using a user's ID token, you have to authenticate as the user (effectively impersonating them) before being able to perform any actions on behalf of said user.
The better solution would be to use an Admin SDK to perform that task. By authenticating your requests to the Firebase REST APIs with Service Account Credentials as described in
Add the Firebase Admin SDK to Your Server, you will be able to perform administrative tasks (like deleting a user from the authentication database) more easily.
Here are the steps to get started with Service Account based authentication:
Generate Service Account credentials on https://console.firebase.google.com/project/_/settings/serviceaccounts/adminsdk
Use the Google Auth Library for PHP to be able to make authenticated calls the Google/Firebase APIs https://github.com/googleapis/google-auth-library-php#call-the-apis
When you have created an HTTP client with the help of the Auth library, you can call this API endpoint to delete the user
$client->post('https://www.googleapis.com/identitytoolkit/v3/relyingparty/deleteAccount', [
'json' => [
'localId' => 'uid-of-user-to-delete'
]
]);
The localId parameter is not documented on https://firebase.google.com/docs/reference/rest/auth/#section-delete-account, but it's used from within the official admin SDK and works.
Using an Admin SDK (https://firebase.google.com/docs/admin/setup#initialize_the_sdk) would be the recommended way to perform administrative tasks like this. Official SDKs exist for Node.js, Java, Python, Go and C# - I maintain an unofficial one for PHP that you can find at https://github.com/kreait/firebase-php. With it, you could perform the same task like this:
// kreait/firebase-php ^5.0
$factory = (new Factory)->withServiceAccount('service_account.json');
$auth = $factory->createAuth();
$auth->deleteUser('uid-of-user-to-delete');
// kreait/firebase-php ^4.0
$serviceAccount = ServiceAccount::fromJsonFile('service_account.json');
$firebase = (new Factory())
->withServiceAccount($serviceAccount)
->create();
$firebase->getAuth()->deleteUser('uid-of-user-to-delete');
On a side note:
I would consider storing a user's ID token in a separate database a security risk: if your database gets compromised, attackers gain access to your user's ID tokens and can use those who aren't expired yet to access your application.
The recommended flow to pass a user from your frontend (web, mobile) to your backend (server) is:
Use a Firebase Client SDK in your frontend, e.g. in your web application
Let the user sign in to Firebase in the frontend via the client SDK, and when a user successfully signed in, retrieve the ID token on your client, send it to your backend and verify the ID token on your backend.
Once you've verified the ID token, you can extract the Firebase ID of your user from the ID token and save it to your database, e.g. in a table that maps your local user id to the Firebase User ID without the need to store their full ID token (= full credentials)
What I have:
Twitter app created at twitter and PHP app at localhost
What I want:
post tweets/update statuses via twitter API from only(!) the app account.
No twitter#anywhere, no user login, nothing fancy.
What I tried:
https://github.com/abraham/twitteroauth with access tokens from the dev.twitter.com website, returned
"POST data is not available with this
token"
or something like that.
code snippet I found on some website:
// Define credentials for the Twitter account
define('TWITTER_CREDENTIALS', 'username:password');
// Set up CURL with the Twitter URL and some options
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://twitter.com/statuses/update.xml?status=test_status');
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 2);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Twitter uses HTTP authentication, so tell CURL to send our Twitter account details
curl_setopt($ch, CURLOPT_USERPWD, TWITTER_CREDENTIALS);
// Execute the curl process and then close
$data = curl_exec($ch);
curl_close($ch);
// If nothing went wrong, we should now have some XML data
echo '<pre>'.htmlentities(print_r($data, true)).'</pre>';
returned
"Basic authentication is not
supported"
That big code snippet uses basic authentication, which is no longer supported by Twitter. Disregard it.
OAuth is now required by Twitter instead, which is what abraham's twitteroauth library uses. You will have to log in/authenticate using this, at least once.
You will also have to first register your app with Twitter, to receive your own Consumer Key and Consumer Secret. Then you'll be able to start using Twitter's API via twitteroauth.
Okay I've found what's the problem.
By default, Twitter sets all apps to read-only, so even when you login via PHP, you can't send POST/UPDATE. What you need to do is go to your application settings (the one where you set app name, description and avatar) and before avatar there's a "default access type", switch it to
Read, Write, & Direct Messages
and voila.
to test the app use this snippet
$twitter = new \TwitterOAuth('consumer_key', 'consumer_secret',
'(oauth_token', 'oauth_token_secret');
$twitter->get('account/verify_credentials');
$twitter->post('statuses/update', array('status' => 'test status'));
Oh and you don't need to do the login stuff with your app, you get the required tokens under "My access Token" menu.