Using bearer token for authentication for end points

[Q&A] Components, Datasets and Plug-ins
1

Hi,

How would I go about setting up bearer tokens as the authentication type for the data definition end points (GET end points)? Do I need a specific revision of the M8465 Novulo Data and processes for REST HV? Or do I need to have other components enabled?

2

Hi,
Currently there are 2 types of authentication:

  • Service authentication type - which as of now supports 2 sub-types, but a change is in the works and is close to being released. These are:
  1. Basic - a back-end novulo user. Provided in the Authorization header of the REST call (Basic username:password , where the username:password part is base64 encoded string)
  2. Impersonation - a user is pre-configured on the REST Endpoint configuration. The user record to which is configured via the expression, is the user that will be used to authenticate the request (no Authorization header needs to be provided in these endpoints. endpoints that use Impersonation service authentication type are public.

Soon the “Basic” would be replaced with “Authorization”, when the Novulo implementation for OAuth2.0 is released - this means that when this value is selected, the supported authentications would be:

  • Basic, as it is now
  • Bearer token - token based authentication based on the OAuth2.0 standard. Provided in the Authorization header in format Bearer token

Service authentication type is purely for the back-end users (i.o.w. the users you use to log-in in the Novulo application itself)

However, even now, there is additional “layer” of authentication that can be enabled - this is the “Require website user authentication”
image
The website (CMS) user authentication is for CMS users (a provider would be M3031 Novulo CMS)
CMS users authentication is provided in a custom header with name “UserAuthorization” - the value is in the format “Bearer token”

Does that answer your question @heppener_anker ?

Greetings,
Miroslav

3

Hi Miroslav,

Thank you for your answer. Then I will wait for the release of OAuth2.0 so that I can use the token based authentication based on the OAuth2.0 standard.

4

Hi Miroslav,

One more thing. Do you have a timeframe of when the Bearer token based on OAuth2.0 will be expected to be released?

Greetings,

Timothy

5

Hi,

I don’t have an exact date, but currently the initial implementation is under review.

Greetings,
Miroslav

1 Like
6

Hi,

Are there any updates around OAuth 2 support? This would help al lot when integrating an external identity provider / proxy like Okta, Firebase, etc within our portal.

Peter

7

Hi @Peter , @heppener_anker , anyone else interested:

Please refer to Novulo OAuth2.0 configuration and usage

Also ensure that you use:

  • Latest M8465 and M8737
  • Latest M9939 (and configure it according the wiki i linked above)
  • Upgrade M9445 to latest (rev >=29) if you have it in your application.

Looking forward any feedback that you might have.

Greetings,
Miroslav

4 Likes