HTTP requests for WSO2 Identity Server user authentication

Question

I am writing a REST API to be consumed by our internal applications. I need to login and logout users of the identity server using code grant via http requests

presentation

I need to know how to call the following endpoints:

• /authorize (invoked from server-side)
• /accesstoken (invoked from server-side)
• /login
• /logout

CASE:

Our company has many applications. I want one point of authentication which will happen in their company-x account like how you only need to login to atlassian account to access jira and confluence cloud. The REST API I'm working is for our front-end developers (as of now).

presentation

I cannot simply let the user login to WSO2 IS since they only need a module where they can manage their company-x profile and other basic stuffs. By this I think I have 2 options:

1. Customize WSO2 Identity Server UI and permissions. But the problem is, I still need an endpoint to get that id_token. I am also not sure if this is the right approach.
2. Know how to call /authorize, /accesstoken, /login and /logout endpoint and write my own minimal required UI and provide an endpoint that will respond the id_token

Answer 1

How about having a basic login page on front-end and use request path authenticator to get the authorization code/id_token.

Basically what this means is instead of redirecting the user to IS login page you can extract the username and password from the basic login page you created and send the authorization grant request along with the credentials.

so your authorization code request will be:

https://localhost:9443/oauth2/authorize?response_type=code&client_id=JqB4NGZLMC6L3n4jz094FMls2Joa&redirect_uri=https://localhost/callback&scope=openid&sectoken=<sec_token>

sec_token = base64encode(username:password)

You need to add basic-auth request path authenticator in your Service Provider configurations. This request should return you an authorization code. If you want an id_token simply use the implicit flow with request path authentication.

Answer 2

If you use code grant type, there will be a browser redirection from /authorize to /login. I don't think you can handle that by a REST call. (You might be able to handle that by calling url in location header of each 302 response. But I don't think it's a nice way to do this.) If you want to develop a REST API, I think password grant type will be more suitable.