Xbase++ Requires Chilkat v11.0.0+

OAuth2 Token using IdentityServer4 with Client Credentials

See more OAuth2 Examples

Demonstrates how to get an OAuth2 access token using the client credential flow with IdentityServer4. Xbase++

LOCAL nSuccess
LOCAL oHttp
LOCAL oResp
LOCAL oJson
LOCAL cTokenEndpoint
LOCAL oGrantTypes
LOCAL nClientCredentialsIdx
LOCAL oReq
LOCAL cAccessToken

nSuccess := 0

//  This example assumes the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

oHttp := CreateObject("Chilkat.Http")

//  The first step is to fetch your IdentityServer4's discovery document
//  (OpenID Connect defines a discovery mechanism, called OpenID Connect Discovery, where an OpenID server publishes its metadata at a well-known URL, 
//  typically https://server.com/.well-known/openid-configuration

oResp := CreateObject("Chilkat.HttpResponse")
nSuccess := oHttp:HttpNoBody("GET", "https://localhost:5000/.well-known/openid-configuration", oResp)
IF (nSuccess == 0)
    ? oHttp:LastErrorText
    oHttp:destroy()
    oResp:destroy()
    RETURN
ENDIF

IF (oResp:StatusCode != 200)
    ? "Received response status code " + Str(oResp:StatusCode)
    ? "Response body containing error text or JSON:"
    ? oResp:BodyStr
    oHttp:destroy()
    oResp:destroy()
    RETURN
ENDIF

oJson := CreateObject("Chilkat.JsonObject")
nSuccess := oJson:Load(oResp:BodyStr)

//  We have the discovery document, which contains something like this:

//  You can use this online tool to generate parsing code from sample JSON: 
//  Generate Parsing Code from JSON

//  {
//    "issuer": "https://localhost:5000",
//    "jwks_uri": "https://localhost:5000/.well-known/openid-configuration/jwks",
//    "authorization_endpoint": "https://localhost:5000/connect/authorize",
//    "token_endpoint": "https://localhost:5000/connect/token",
//    "userinfo_endpoint": "https://localhost:5000/connect/userinfo",
//    "end_session_endpoint": "https://localhost:5000/connect/endsession",
//    "check_session_iframe": "https://localhost:5000/connect/checksession",
//    "revocation_endpoint": "https://localhost:5000/connect/revocation",
//    "introspection_endpoint": "https://localhost:5000/connect/introspect",
//    "frontchannel_logout_supported": true,
//    "frontchannel_logout_session_supported": true,
//    "backchannel_logout_supported": true,
//    "backchannel_logout_session_supported": true,
//    "scopes_supported": [
//      "openid",
//      "profile",
//      "email",
//      "MyCompany.profile",
//      "MyCompany.Identity.WebApi",
//      "MyCompany.TriHub.WebApi",
//      "offline_access"
//    ],
//    "claims_supported": [
//      "sub",
//      "updated_at",
//      "locale",
//      "zoneinfo",
//      "birthdate",
//      "gender",
//      "website",
//      "profile",
//      "preferred_username",
//      "nickname",
//      "middle_name",
//      "given_name",
//      "family_name",
//      "name",
//      "picture",
//      "email_verified",
//      "email",
//      "userId",
//      "groups",
//      "fullname"
//    ],
//    "grant_types_supported": [
//      "authorization_code",
//      "client_credentials",
//      "refresh_token",
//      "implicit",
//      "password"
//    ],
//    "response_types_supported": [
//      "code",
//      "token",
//      "id_token",
//      "id_token token",
//      "code id_token",
//      "code token",
//      "code id_token token"
//    ],
//    "response_modes_supported": [
//      "form_post",
//      "query",
//      "fragment"
//    ],
//    "token_endpoint_auth_methods_supported": [
//      "client_secret_basic",
//      "client_secret_post"
//    ],
//    "subject_types_supported": [
//      "public"
//    ],
//    "id_token_signing_alg_values_supported": [
//      "RS256"
//    ],
//    "code_challenge_methods_supported": [
//      "plain",
//      "S256"
//    ]
//  }
//  

//  The next steps are to (1) get the token_endpoint,
//  and (2) verify that the client_credentials grant type is supported.

cTokenEndpoint := oJson:StringOf("token_endpoint")

oGrantTypes := oJson:ArrayOf("grant_types_supported")
nClientCredentialsIdx := oGrantTypes:FindString("client_credentials", 1)
oGrantTypes:destroy()

//  If clientCredentialsIdx is less then zero (-1) then the "client_credentials" string was not found.
IF (nClientCredentialsIdx < 0)
    ? "The client credentials grant type is not supported."
    oHttp:destroy()
    oResp:destroy()
    oJson:destroy()
    RETURN
ENDIF

//  Request the access token using our Client ID and Client Secret.
//  We're going to duplicate this CURL statement:

//  curl --request POST \
//    --url '<tokenEndpoint>' \
//    --header 'content-type: application/x-www-form-urlencoded' \
//    --data 'grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET'

oReq := CreateObject("Chilkat.HttpRequest")
oReq:HttpVerb := "POST"
oReq:ContentType := "application/x-www-form-urlencoded"

oReq:AddParam("grant_type", "client_credentials")
oReq:AddParam("client_id", "CLIENT_ID")
oReq:AddParam("client_secret", "CLIENT_SECRET")oReq:HttpVerb := "POST"

nSuccess := oHttp:HttpReq(cTokenEndpoint, oReq, oResp)
IF (nSuccess == 0)
    ? oHttp:LastErrorText
    oHttp:destroy()
    oResp:destroy()
    oJson:destroy()
    oReq:destroy()
    RETURN
ENDIF

//  Make sure we got a 200 response status code, otherwise it's an error.
IF (oResp:StatusCode != 200)
    ? "POST to token endpoint failed."
    ? "Received response status code " + Str(oResp:StatusCode)
    ? "Response body containing error text or JSON:"
    ? oResp:BodyStr
    oHttp:destroy()
    oResp:destroy()
    oJson:destroy()
    oReq:destroy()
    RETURN
ENDIF

nSuccess := oJson:Load(oResp:BodyStr)

//  Our JSON response should contain this:
//  {
//    "access_token":"eyJz93a...k4laUWw",
//    "token_type":"Bearer",
//    "expires_in":86400
//  }

//  Get the access token:
cAccessToken := oJson:StringOf("access_token")

//  The access token is what gets added to "Authorization: Bearer <access_token>"
//  for the subsequent REST API calls..

oHttp:destroy()
oResp:destroy()
oJson:destroy()
oReq:destroy()