Choosing OAuth2 Grant

Thomas Barbieri · 2024-10-29T20:18:25+00:00

There was an error rendering this rich post.

I'm building a local repository in python. I want to use the requests library to call an Infor API. I'm a bit confused on how to handle authentication with Infor in order to generate a token within my code. Would a python script be considered a backend service app and need a resource owner grant with service account? At this point I'm using postman to test Infor APIs and I manually authenticate through the postman interface.

Find more posts tagged with

Accepted answers

Prabodha Amarapema

Yes, it should work. You need to obtain the token and pass the token with subsequent ION AP calls.

If you need more information refer below.

https://developer.infor.com/apis/

All comments

Prabodha Amarapema

Yes, it should work. You need to obtain the token and pass the token with subsequent ION AP calls.

If you need more information refer below.

https://developer.infor.com/apis/

CeligoLabs

Hi, we're also working on an integration with Infor’s APIs for celigo and had a similar question regarding authentication. Based on the response, it seems like obtaining the OAuth token is the first step, but I couldn’t find clear documentation on whether the token URL is standardized (e.g., https://api.infor.com/oauth2/token) or if it varies per tenant.

Can someone confirm how the token URL should be constructed dynamically for different instances? If it’s tenant-specific, is there a recommended way to retrieve the correct authentication URL programmatically?

Would appreciate any clarification or pointers to detailed documentation on this. Thanks!

Kevin Heiman

API Administration documentation has a section on client development with some links to sample code.
Assuming the grant is Password/Resource Owner, then you have the ionapi file which has all the dynamic answers you need. Having the ionapi file dynamically incorporated through a secrets server is ideal , allowing rotation of credentials on your security requirements.
Some quick thoughts suggesting that you ;

use Service User accounts vs using User Accounts in you service account setup into the ionapi file.
Use refresh token logic vs new tokens best practice (see below)
create specific Service accounts to me able to manage/monitor an API client.
1. Clients can support scopes to offer additional layer of security
2. Client associated Service Account can have unique functional level security in the target API suite, essentially as a proxy of the service account used.
API Gateway supports tracing in the headers . These can be invaluable in diagnosing failures, especially in support incidents.
Alway monitor for status codes and handle appropriately
Most suites have limits on volume, so applying API concepts of backoff, jitter, retries is important.
Use reasonable Pagination where supported in the API

The best practice for tokens is to retrieve the first token, then keep that token in your secrets for subsequent client connections. Each bearer token has a expire and a Refresh token allowing you to watch for expire and request a refresh token versus a new token. Token requests are licensed and a relatively low volume is expected.

The examples are JAVA and .net. I have several examples in Python shared previously. I am not a Python expert so these could be improved.

Building a connection from ionapi file

IONAPIFileLocation = './creds/myionapifile.ionapi'

with open(IONAPIFileLocation, 'r') as ionapi_read:

    ionapi = json.load(ionapi_read)

ionapi_read.close()

# set up required params for Authentication

client_id = ionapi["ci"]

tenantid = ionapi["ti"]

client_secret = ionapi["cs"]

username = ionapi["saak"]

password = ionapi["sask"]

ionapiTokenURL = ionapi["pu"]+ionapi["ot"]

if debugmode:

    print("Tenant ID: " + tenantid)

    print("Token URL: " + ionapiTokenURL)

#

# get the oauth2 security token

oauth = OAuth2Session(client=LegacyApplicationClient(client_id=client_id))

token = oauth.fetch_token(token_url=ionapiTokenURL,

                          username=username,

                          password=password,

                          client_id=client_id,

                          client_secret=client_secret

                          )

tokenExpire = token['expires_at']

print("Token details ---------------")

print("token retrieved type " + str(token['token_type']) +

      " using : " + ionapiTokenURL)

print("Token Expire Date Time act: " +

      str(datetime.fromtimestamp(tokenExpire)))

#

if debugmode:

    print("token type : " + str(token['token_type']))

    print("token      : " + str(token['access_token']))

    print("token expires in : " + str(token['expires_in']))

    print("token expires at : " + str(tokenExpire))

    print("token refresh : " + str(token['refresh_token']))

#

Token refresh

while RowCount > resultOffset:   

    # >> An example of refresh checking. Does not logically apply

    #    in this Sample Application..

    # This check is dependent upon the API invocation frequency.

    # https://docs.infor.com/ionapi/2021-x/en-us/ionapiag_cloud/default.html?

    #                helpcontent=zck1583275849374.html

    # If time on token has expired, Get a new one.

    # ..Alternative is to Check Response code of API call for Authorization

    #  error, and invoke this code.

    # Subtract 60 seconds to prevent overlap, depends on your logic use case.

    if time.time() > tokenExpire - 60:

        print(" ..Token refresh...")

        extra = {'client_id': client_id,

                 'client_secret': client_secret,

                 'refresh_token': token['refresh_token']

                 }

        oauth_refresh = OAuth2Session(client_id, token=token)

        # request a new access token with the refresh token

        token = oauth_refresh.refresh_token(ionapiTokenURL, **extra)

        if debugmode:

            print("token type : " + str(token['token_type']))

            print("token expires in : " + str(token['expires_in']))

            print("token expires at : " + str(token['expires_at']))

            print("token refresh : " + str(token['refresh_token']))

            # print("token scope : " + str(token['scope']))

        TokenExpiresDatetimeTime = datetime.fromtimestamp(token['expires_at'])

        print("Token Expire Date Time : " + str(TokenExpiresDatetimeTime))

    #     set up api call headers with the New Authorization

    #      for subsequent ION API calls

    ionapiHeaders = {

            'accept': 'application/json',

            'Authorization': token["token_type"] + " " + token["access_token"],

            'X-TenantId': ionapi["ti"],

            "Content-Type": "application/json",

        }

# end of token refresh sample

Jitter when looping or retrying (retrying should backoff as well)

    # wait a jittered amount

    SleepMilliSeconds = (random.randrange(5) / 10)

    time.sleep(SleepMilliSeconds)

Checking for response codes

   #  Success response

    if JobResult_response.status_code == 200:

        JobResult_responsecsv = \

            JobResult_response.content.decode('utf-8')

    else:

        # 400  Bad Request

        # 403  Compass operations are not allowed

        # 404  Result not Found

        # 406  Requested media type doesnt match format

        # 500  Server Error

        # determine if a retry is needed

        print(" job result failed..:" +

              str(JobResult_response.status_code) +

              ": ..")

Hopefully that is a helpful in your journey. I am open to feedback and improvements, or further questions.