Java：访问使用SAML身份验证的API

Question

I have a web project that needs to pull some data from a hosted versionone instance. The versionone instance uses SAML authentication for single sign-on. The single sign-on itself uses a username and pin+one-time password for authentication so it is nearly impossible to hard-code those values into the application.

Is there a way to handle this situation? Can I set something in the header of the request to bypass the single-signon process?

Answer 1

As of release 13.1, VersionOne supports OAuth2 for authentication against the API endpoints. Both the Webserver flow (where the hosted instance POSTs auth tokens to your waiting HTTP server) and the Out-of-band flow (where the hosted instance gives the user a code to copy/paste to the client) are supported.

That may be a better match for your requirements, as the SAML process is difficult to complete without a web browser and user present.

Once the OAuth2 credentials are obtained by the app, it can operate without user intervention. At any time, the user may revoke the app's permissions inside of VersionOne.

With OAuth2, the process is:

1. Register your app with VersionOne, thus creating a client secret

2. Configure the app with the client secret data from the registration

3. Have the app request a permission grant, which sends you to the VersionOne server.

4. Login to the server as the user you wish the app to act as, and accept the grant.

5. Copy the grant code back to the app if using the out-of-band flow.

6. The app contacts the VersionOne instance and exchanges the code for a persistent token.

7. The app can apply the token as an "Authorization: Bearer " HTTP header to achieve access to the VersionOne endpoint

8. If the token has expired and the request returns Unauthorized, the client may attempt to refresh the token and try again, without user intervention.

There is some documentation available on the VersionOne community site .

And a few (in-progress) examples in the VersionOne OAuth2 Examples repository

We also have a (beta) HTTP proxy that can run on your app's server, forwarding requests to the VersionOne instance after wrapping them with OAuth2 and SSL.