-
Notifications
You must be signed in to change notification settings - Fork 31
/
Copy pathwebex-auth.html
executable file
·216 lines (196 loc) · 9.74 KB
/
webex-auth.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
<!DOCTYPE html>
<html>
<script type="text/javascript">
//Sample application demonstrating how to perform a Webex OAuth2 authentication and Webex API access token request
//Note: this page must be accessed from a web server, Step #3 below may fail if loaded from the file system
// Helper function that generates a random alpha/numeric string
var randomString = function(length) {
var str = "";
var range = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
for(var i = 0; i < length; i++) {
str += range.charAt(Math.floor(Math.random() * range.length));
}
return str;
}
// Helper function that parses a query string into a dictionary object
var parseQueryStr = function( queryString) {
var params = {}, keyvals, temp, i, l;
keyvals = queryString.split("&"); // Split out key/value pairs
for ( i = 0, l = keyvals.length; i < l; i++ ) { // Split key/value strings into a dictionary object
tmp = keyvals[i].split('=');
params[tmp[0]] = tmp[1];
}
return params;
};
// Step #1: Fires when the user clicks the 'Request Auth Code' button
function codeClick() {
var appClientId = document.getElementById('clientId').value;
var appRedirectUri = document.getElementById('redirectUri').value;
var appOAuthScopes = document.getElementById('oauthScopes').value;
var appStateValue = document.getElementById('stateValue').value;
// Store client id and secret in localstorage (NOTE: THIS IS NOT A SECURE WAY TO STORE SECRETS)
var appClientSecret=document.getElementById('clientSecret').value;
localStorage.setItem('appClientId', appClientId);
localStorage.setItem('clientSecret', appClientSecret);
//Build the request URL.
var requestUrl = 'https://webexapis.com/v1/authorize?' +
'response_type=code&' +
'scope=' + encodeURIComponent(appOAuthScopes) + '&' +
'state=' + encodeURIComponent(appStateValue) + '&' +
'client_id=' + encodeURIComponent(appClientId) + '&' +
'redirect_uri=' + encodeURIComponent(appRedirectUri);
window.location = requestUrl;
}
// Step #2: On page load, check if the 'code=' query param is present
// If so user has already authenticated, and page has been reloaded via the Redirect URI
window.onload = function(e) {
document.getElementById('redirectUri').value = window.location.href.split("?")[0]; // Detect the current page's base URL
// Write back the values if they are available
document.getElementById('clientId').value = localStorage.getItem('appClientId');
document.getElementById('clientSecret').value = localStorage.getItem('clientSecret');
var params = parseQueryStr(window.location.search.substring(1)); // Parse the query string params into a dictionary
if (params['code']) { // If the query param 'code' exists, then...
document.getElementById('code').value = params['code']; // Display the auth code
document.getElementById('tokenButton').removeAttribute('hidden'); // Reveal the 'Request Access Token' button
}
if (params['state']) { // If the query param 'state' exists, then...
document.getElementById('stateDisplay').value = params['state']; // Display the state parameter
}
if (params['error']) { // If the query param 'error' exists, then something went wrong...
alert('Error requesting auth code: ' + params['error'] + ' / ' + params['error_description']);
}
}
// Step #3: Fires when the user clicks the 'Request Access Token' button
// Takes the auth code and requests an access token
function tokenClick() {
var appClientId = document.getElementById('clientId').value;
var appClientSecret = document.getElementById('clientSecret').value;
var appRedirectUri = document.getElementById('redirectUri').value;
var appStateValue = document.getElementById('stateValue').value;
var xhttp = new XMLHttpRequest(); // Create an AJAX HTTP request object
xhttp.onreadystatechange = function() { // Define a handler, which fires when the request completes
if (xhttp.readyState == 4) { // If the request state = 4 (completed)...
if (xhttp.status == 200) { // And the status = 200 (OK), then...
var authInfo = JSON.parse(xhttp.responseText); // Parse the JSON response into an object
document.getElementById('token').value = authInfo['access_token']; // Retrieve the access_token field, and display it
document.getElementById('refresh').value = authInfo['refresh_token']; // Retrieve the refresh_token field, and display it
if (document.getElementById('token').value) {
document.getElementById('tokenRefReshButton').removeAttribute('hidden'); // Reveal the 'Refresh Access Token' button
}
} else alert('Error requesting access token: ' + xhttp.statusText)
}
}
xhttp.open('POST', 'https://webexapis.com/v1/access_token', true); // Initialize the HTTP request object for POST to the access token URL
// Build the HTML form request body
var body = 'grant_type=authorization_code&'+ // This is an OAuth2 Authorization Code request
'state=' + encodeURIComponent(appStateValue) + '&' +
'redirect_uri='+encodeURIComponent(appRedirectUri)+'&'+ // Same custom app Redirect URI
'code='+encodeURIComponent(document.getElementById('code').value)+'&'+ // User auth code retrieved previously
'client_id='+encodeURIComponent(appClientId)+'&'+ // The custom app Client ID
'client_secret='+encodeURIComponent(appClientSecret); // The custom app Client Secret
xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); // Sending the content as URL-encoded form data
xhttp.send(body); // Execute the AJAX HTTP request
}
// Step #4: Fires when the user clicks the 'Refresh Access Token' button
// Takes the auth code and requests an access token
function tokenRefreshClick() {
var appClientId=document.getElementById('clientId').value;
var appClientSecret=document.getElementById('clientSecret').value;
var appRedirectUri=document.getElementById('redirectUri').value;
xhttp = new XMLHttpRequest(); // Create an AJAX HTTP request object
xhttp.onreadystatechange = function() { // Define a handler, which fires when the request completes
if (xhttp.readyState == 4) { // If the request state = 4 (completed)...
if (xhttp.status == 200) { // And the status = 200 (OK), then...
var authInfo = JSON.parse(xhttp.responseText); // Parse the JSON response into an object
document.getElementById('token').value = authInfo['access_token']; // Retrieve the access_token field, and display it
document.getElementById('refresh').value = authInfo['refresh_token']; // Retrieve the refresh_token field, and display it
} else alert('Error requesting access token: ' + xhttp.statusText)
}
}
xhttp.open('POST', 'https://webexapis.com/v1/access_token', true); // Initialize the HTTP request object for POST to the access token URL
// Build the HTML form request body
var body = 'grant_type=refresh_token&'+ // This is an OAuth2 Authorization Code request
'refresh_token='+encodeURIComponent(document.getElementById('refresh').value)+'&'+ // User auth code retrieved previously
'client_id='+encodeURIComponent(appClientId)+'&'+ // The custom app Client ID
'client_secret='+encodeURIComponent(appClientSecret); // The custom app Client Secret
xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); // Sending the content as URL-encoded form data
xhttp.send(body); // Execute the AJAX HTTP request
}
</script>
<style type="text/css">
body {font: 14px/1.55 'CiscoSansLight', Arial,'Liberation Sans',FreeSans,sans-serif;}
.glasspane {background: #049fd9; height: 40px; width: 850px; display: inline; float: left;}
.glasspane h1 {opacity: 1; color: #fff; margin-top: 2px; margin-bottom: 0; font-weight: normal; font-size:25px; padding-left:10px}
.table {margin: 10px 0 0 0; float:left; background-color: #eee; padding: 10px;}
td:first-child {width: 116px;}
input, textarea {width: 700px; display: block;}
textarea {height: 140px;}
.wrapper {width: 900px; float:left;}
</style>
<head>
<title>Webex APIs Authentication Demo</title>
</head>
<body>
<div class="wrapper">
<div class="glasspane">
<h1>Webex APIs Authentication Demo</h1>
</div>
<div class="table">
<table>
<tr>
<td>Client ID:</td>
<td><input id="clientId"/></td>
</tr>
<tr>
<td>Client Secret:</td>
<td><input id="clientSecret"/></td>
</tr>
<tr>
<td>OAuth Scopes:</td>
<td><input id="oauthScopes" value="spark:rooms_read"/></td>
</tr>
<tr>
<td>State:</td>
<td><input id="stateValue" value="MyAuthState"/></td>
</tr>
<tr>
<td>Redirect URI:</td>
<td><input id="redirectUri"/><button name="codeButton" type="button" onClick="codeClick()">Request Auth Code</button></td>
</tr>
</table>
</div>
<div class="table">
<table>
<tr>
<td>Returned State:</td>
<td><input id="stateDisplay" readonly/></td>
</tr>
<tr>
<td>Auth Code:</td>
<td><input id="code" readonly/> <button id="tokenButton" type="button" hidden onClick="tokenClick()">Request Access Token</button></td>
</tr>
</table>
</div>
<div class="table">
<table>
<tr>
<td>Access Token:</td>
<td><textarea id="token" readonly style="vertical-align: top"></textarea></td>
</tr>
<tr>
<td>Refresh Token:</td>
<td><textarea id="refresh" readonly style="vertical-align: top"></textarea></td>
</tr>
</table>
</div>
<div class="table">
<table>
<tr>
<td>Refresh the token:</td>
<td><button id="tokenRefReshButton" type="button" hidden onClick="tokenRefreshClick()">Refresh Access Token</button></td>
</tr>
</table>
</div>
</div>
</body>
</html>