OAuth2 (SUSI) token creation plugin for
This plugin is intended to be used in conjunction with the
aio-lib-core-ims extending that to support browser based 3-legged OAuth2 authentication with IMS commonly known as SUSI flow.
For more information about the general setup of the Adobe I/O CLI IMS Plugin, please refer to
The 3-legged OAuth2 requires interaction with a browser as the initial authentication step to receive the authorization code may be involving multiple browser based steps. For example an IMS Enterprise integration may involve further redirects to a 3rd party for actual authentication.
- A 4-byte random pass-code is generated
- A localhost web server is created, listening at a port number
- An Adobe I/O Runtime web action is opened in the browser, passing in this pass-code, the localhost web server port number, the client id, and the IMS scope as query parameters
- The Adobe I/O Runtime web action will redirect to the IMS authorization endpoint, with the scope, client id and a csrf token as the
stateproperty (derived from the id, client id, scope and localhost port) passed in as query parameters
- When the user is authenticated or an error occurs, the IMS endpoint will redirect to the Adobe I/O Runtime web action's
- If the authentication is successful, the Adobe I/O Runtime web action will redirect to the localhost web server at the specified port (derived from the
stateproperty), and forward the
codeproperties to the localhost web server call as query parameters
- The localhost web server will pass on the authorization code to the library, and the library will call an IMS endpoint to exchange the authorization code for an access token and refresh token
- If the authentication is not successful, the Adobe I/O Runtime web action will report an error message in the web browser
The Adobe I/O Runtime function used (currently in testing) is coming soon.
oauth2 context into your
.aio file in your current working directory (project folder), under
$ims:oauth2:redirect_uri: "YOUR_REDIRECT_URI"client_id: "YOUR_CLIENT_ID"client_secret: "YOUR_CLIENT_SECRET"scope: "YOUR_IMS_SCOPE"
The context can be named anything (here
oauth2 is chosen for the context name).
Contributions are welcomed! Read the Contributing Guide for more information.
This project is licensed under the Apache V2 License. See LICENSE for more information.