This is the second of a series of posts related to OAuth-2.0 grant types in WSO2 API Manager (WSO2 Carbon platform). Therfore, I strongly suggest you to read and work on the examples described in the first post before proceeding with this.
In this post, we will go through Implicit grant type which is the recommended practice if your application (client) is a mobile application or a browser based app such as a JavaScript client. The key difference of implicit grant when comparing to the Authorization Code is, the client receives access token as the result of the authorization request. In our previous post, which was about Authorization Code grant, client had to make separate requests for authorization and access token. Also note that, the implicit grant does not include client authentication because it does not make use of client secret.
Before attempting to work on the sample, let's have a look at the steps involved in implicit grant type.
When you click on "authorize" with all required parameters, the application generates the above HTTP GET call and you will be redirected to the user consent screen as shown below.
![]()
Click on Authorize. You will be provided with options to enter user name and password (username and password of the resource owner/end user).
Type admin/admin as user name and passeword respectively and click on login.
You will receive the Access Token as shown below.
![]()
Now, we can use this access token to do the actual API call.
We will explore Client Credentials OAuth-2.0 grant type in our next post.
In this post, we will go through Implicit grant type which is the recommended practice if your application (client) is a mobile application or a browser based app such as a JavaScript client. The key difference of implicit grant when comparing to the Authorization Code is, the client receives access token as the result of the authorization request. In our previous post, which was about Authorization Code grant, client had to make separate requests for authorization and access token. Also note that, the implicit grant does not include client authentication because it does not make use of client secret.
Before attempting to work on the sample, let's have a look at the steps involved in implicit grant type.
1. Application (client) does a token request from the authorization server by sending a HTTP GET request with the following query parameters.
response_type = token
client_id = VALUE_OF_CONSUMER_KEY
redirect_uri = REDIRECT_URL_OF_THE_APPLICATION
scope = SCOPE_OF_THE_ACCESS_REQUEST
The first two are mandatory parameters where as the last two can be optional.
2. Upon receiving the request, the authorization server must return a 302 redirection back to the client with an Location header pointing to the URL of user consent page. (e.g:- Location: https://localhost:9443/carbon/oauth/oauth2_authn_ajaxprocessor.jsp)
3. User (resource owner) confirms the authorization requested by client (application) by specifying his credentials.
4. Authorization server redirects user back to the application (to the callback url which has been specified at the first step) with the access token.
Let's explore more on the above steps, using our sample web application (acts as the client/application) and WSO2 API Manager (acts as the authorization server).
Step 1
Access the OAuth playground application as instructed in "Setting up client" section in the previous post. Once you click on "Import Photos" icon, you will be landed in a page where you will find a form with various options such as Authorization Grant Type, Client Id etc..
Step 2
Select Implicit as the Authorization Grant Type.
Copy the consumer key value from the application you have subscribed in WSO2 API Manager (see above) and enter it in Client Id text box.
Specify any string value as scope. We do not really worry about scope attribute in this example.
Enter callback URL which must be identical to the value you have specified at the time of creating the new application in WSO2 API Manager.
e.g:- http://localhost:8090/playground2.0/oauth2client
Enter Authorize endpoint. This should be the endpoint of authorization server where it accepts the authorization requests. In WSO2 API Manager, there is an API to handle all authorization requests and it can be accessed through http://localhost:8280/authorize.
Once you completed adding all values in the form in the playground app, click on Authorize.
Once you completed adding all values in the form in the playground app, click on Authorize.
This will generate HTTP GET request similar to the following. You can see it contains all mandatory URL parameters which we have discussed in point 1 under the general introduction of "Implicit grant type".
GET /authorize?scope=api_scope&response_type=token&redirect_uri=http%3A%2F%2Flocalhost%3A8090%2Fplayground2.0%2Foauth2client&client_id=ePCzEHajPOZRKus4XS3pva_Ec5Ua HTTP/1.1
Host: 127.0.0.1:8281
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,es;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: keep-alive
Referer: http://127.0.0.1:8090/playground2.0/oauth2.jsp?reset=true
Cookie: i18next=en-US; region1_configure_menu=none; region3_registry_menu=none; region4_monitor_menu=none; region5_tools_menu=none
Step 3
Click on Authorize. You will be provided with options to enter user name and password (username and password of the resource owner/end user).
Type admin/admin as user name and passeword respectively and click on login.
Step 4
You will receive the Access Token as shown below.
Now, we can use this access token to do the actual API call.
We will explore Client Credentials OAuth-2.0 grant type in our next post.
