-
Notifications
You must be signed in to change notification settings - Fork 56
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pass arbitrary httr2 request config to oauth requests #458
Comments
Do you have a pointer to the docs for the API? |
Probably not exactly what you're looking for but limiting myself to publicly available docs (and more informative than the actual docs)-- here's their page on access tokens, and here are their instructions for obtaining a token via Postman, which works fine, as does curl, as does passing Thanks for looking! |
Is this client credentials auth? In which |
That does seem like the right path. Is there a way to pass the certificate and key that way? They're getting passed in the request itself (through library(httr2)
base_endpoint <- "https://api.adp.com"
certfile <- Sys.getenv("ADP_CERTFILE")
keyfile <- Sys.getenv("ADP_KEYFILE")
adp_client <- oauth_client(
id = Sys.getenv("ADP_CLIENT_ID"),
token_url = glue::glue("{base_endpoint}/auth/oauth/v2/token"),
secret = Sys.getenv("ADP_CLIENT_SECRET"),
auth = "body",
name = "adpr"
)
token <- oauth_flow_client_credentials(adp_client,
token_params = (list(sslcert = certfile,
sslkey = keyfile)))
#> Error in `oauth_flow_client_credentials()`:
#> ! OAuth failure [invalid_request]
#> • proper client ssl certificate was not presented
#> Backtrace:
#> ▆
#> 1. └─httr2::oauth_flow_client_credentials(adp_client, token_params = (list(sslcert = certfile, sslkey = keyfile)))
#> 2. └─httr2:::oauth_client_get_token(...)
#> 3. └─httr2:::oauth_flow_fetch(req, "client$token_url", error_call = error_call)
#> 4. └─httr2:::oauth_flow_parse(resp, source, error_call = error_call)
#> 5. └─httr2:::oauth_flow_abort(...)
#> 6. └─cli::cli_abort(...)
#> 7. └─rlang::abort(...) Created on 2024-03-12 with reprex v2.0.2 |
Oh hmmmmm, there's no way to do that currently. I'll have to think about some way to extend the API so it is possible to add additional arbitrary request options to the OAuth request. Or possibly, if this is relatively rare, #435 is the way to go? |
Or I stay in
req_oauth_client_credentials <- function(req,
client,
scope = NULL,
token_params = list(),
curl_opts = list()) {
params <- list(
client = client,
scope = scope,
token_params = token_params,
curl_opts = curl_opts
)
cache <- cache_mem(client, NULL)
req_oauth(req, "oauth_flow_client_credentials", params, cache = cache)
}
#' @export
#' @rdname req_oauth_client_credentials
oauth_flow_client_credentials <- function(client,
scope = NULL,
token_params = list(),
curl_opts = list()) {
oauth_flow_check("client credentials", client, is_confidential = TRUE)
oauth_client_get_token(client,
grant_type = "client_credentials",
scope = scope,
curl_opts = curl_opts,
!!!token_params
)
}
oauth_client_get_token <- function(client,
grant_type,
curl_opts,
...,
error_call = caller_env()) {
req <- request(client$token_url)
req <- req_body_form(req, grant_type = grant_type, ...)
req <- oauth_client_req_auth(req, client)
req <- req_headers(req, Accept = "application/json")
req <- req_options(req, !!!curl_opts)
resp <- oauth_flow_fetch(req, "client$token_url", error_call = error_call)
exec(oauth_token, !!!resp)
} Result library(httr2)
base_endpoint <- "https://api.adp.com"
certfile <- Sys.getenv("ADP_CERTFILE")
keyfile <- Sys.getenv("ADP_KEYFILE")
adp_client <- oauth_client(
id = Sys.getenv("ADP_CLIENT_ID"),
token_url = glue::glue("{base_endpoint}/auth/oauth/v2/token"),
secret = Sys.getenv("ADP_CLIENT_SECRET"),
auth = "body",
name = "adpr"
)
oauth_flow_client_credentials(adp_client,
curl_opts = (list(sslcert = certfile,
sslkey = keyfile)))
#> <httr2_token>
#> token_type: Bearer
#> access_token: <REDACTED>
#> expires_at: 2024-03-12 16:53:59
#> scope: api
req <- httr2::request(glue::glue("{base_endpoint}/hr/v2/worker-demographics")) |>
req_options(sslcert = certfile, sslkey = keyfile)
req_auth <- req_oauth_client_credentials(req, adp_client, curl_opts = (list(sslcert = certfile,
sslkey = keyfile)))
req_perform(req_auth)
#> <httr2_response>
#> GET https://api.adp.com/hr/v2/worker-demographics
#> Status: 200 OK
#> Content-Type: application/json
#> Body: In memory (447831 bytes) Created on 2024-03-12 with reprex v2.0.2 |
Yeah, that's a totally reasonable work around, but I'd prefer something more general for httr2 itself. |
That makes sense: general as in all the |
General, as in applied to all |
Got it; appreciate all the guidance. Shall I close the issue, or do you want me to retitle it as a feature request to pass arbitrary request options to oauth functions and leave it open? |
Leave it open, I think, and hopefully eventually I'll figure out a nice interface for this. |
Great package; thanks!
Is there a way to create an
oauth_client
where authentication requires passing along a certificate and key for mTLS to the token url, together with the id and secret? Example of working non-oauth_client authentication below, but it doesn't benefit from some of the advantages that the oauth code provides, like automatic refresh of the token. In the API I'm dealing with, the access token is simply provided as a bearer token in the Authorization header (currently handled byreq_auth_bearer_token()
), and all requests send the certificate and key.Obtaining token:
Created on 2024-03-12 with reprex v2.0.2
Typical request:
Created on 2024-03-12 with reprex v2.0.2
The text was updated successfully, but these errors were encountered: