Tridion 2011 SP1 HR1 - OData access_token

Question

The online docs mention(requires login) that the access_token JSON returned by a call to the access_token.svc returns something like:

{"access_token":"HufXeuUt%2FYYElA8SYjJOkUkrXxV9dyXRirmKhjW%2Fb%2FU%3D","expires_in":300}

However when we've tried this we get this:

{"access_token":"client_id%3dtestuser%26expiresOn%3d1361873823640%26digest%3dIaiLIug%2bRRYeEszC5syFvlHod9qXWUi0fx4aZFiaS2c%3d","expires_in":300}

The right-hand string decodes as:

client_id=testuser
&expiresOn=1361873823640
&digest=IaiLIug+RRYeEszC5syFvlHod9qXWUi0fx4aZFiaS2c=

When we try and pass this to the subsequent OData call we end up with an exception:

System.IO.IOException: Unable to read data from the transport connection: The connection was closed.

Should we be extracting something out of the encoded string, the "digest" bit perhaps? If so the documentation needs updating!

EDIT

Our logs are showing:

2013-02-26 12:52:46,700 ERROR OAuth2AccessToken - Digest is wrong

No idea why?

Also, we updated the Datasources.xml to enable OAuth and provide the client id/secret - the CM still able to successfully connect and display comments!

It seems that the access token is working correctly for the CM but not in our code.

Answer 1

Like you mentioned, the protocol is this:

1. You make a post request to the access token end-point to get a token (you need to provide here your client_id and your client_secret as headers or as query parameters);

2. You get an answer similar to this: {"access_token":"sometoken","expires_in":300}; 2.1 Worth knowing is that the token is url encoded and in UTF-8 format so, on Java side you need to do URLDecoder.decode("sometoken", "UTF-8"); while on .NET side you need to do HttpUtility.UrlDecode("sometoken", System.Text.Encoding.UTF8);;

3. Your next request needs to include the authorization header. On Java side you do builder.header("authorization", "OAuth " + decodedTokenString); while on .NET side you can use Client.Headers["authorization"] = "OAuth " + DecodedTokenString;

Worth mentioning is that the SharedSecret defined in the cd_webservice_conf.xml (/Configuration/AuthenticationServer/SharedSecret/) of the TokenAccessPoint needs to be the same as the SharedSecret defined in the cd_ambient_conf.xml (/Configuration/Security/SharedSecret/) of the (WebService)EndPoint.

Are you sure you decoded properly the token gotten from the server? Are you sure that you configured the proper SharedSecret in the two configuration files?

Hope this helps.