Need support local oauth_callback HTML page as oAuth2 authentication redirect_uri about cep-resources HOT 10 OPEN

@johnwheeler In your oAuth callback page, you write some script code to get window.location.href, extract access token from it, and then send it using CSEvent. Your main CEP extension should listen to this event and receive the token.

from cep-resources.

@zhangusc ,

If this is a possible solution, we will give it a try and see whether we can hack Chromium so that those web sites can be hosted in an iframe.

from cep-resources.

Hi @zhangusc,

Can you elaborate more on what you mean by It is not a desktop application either and doesn't have control to the browser on which it runs? Thanks.

from cep-resources.

Hi @zhangusc,

If we provide a way with which authorization page could be hosted in an iframe (instead of a new browser window), will "urn:ietf:wg:oauth:2.0:oob" work for you?

from cep-resources.

@lyip1992 In the case of desktop application. Normally, the client application starts an embedded browser to host an oauth login page from the server. If "urn:ietf:wg:oauth:2.0:oob" is specified as the callback of the authentication when sending the request, the server sends back a page with an authorization code or token in its title and content. The client application can then get the code from the page since it has the control of the browser. But in the case of CEP extension, the application itself is running inside a browser, there is no easy way for the extension to get the code from a page sent from server.

from cep-resources.

@dinghui0712 I gave it a try. But currently the browser refuse to load the page sent from oAuth server in an IFrame because the response sets 'X-Frame-Options' to 'SAMEORIGIN'. I don't know how much control you have on the embedded Chromium. But at this point, without changing either the Chromium or the response from the oAuth server, this approach don't seem to work.

from cep-resources.

@dinghui0712, Did you end up supporting urn:ietf:wg:oauth:2.0:oob as a redirect URI?

from cep-resources.

@dinghui0712 No. We ended up hosting a callback page on a web server for the oAuth sign-in workflow

from cep-resources.

@zhangusc Thank you. If you don't mind me asking, how do you pass the OAuth Access Token to the CEP Panel once it's received on the page on the hosted web server?

from cep-resources.

@zhangusc Hello, Can you please explain me your solution?, I was trying to do it but I do not know where should I load the callback page

from cep-resources.