Best method for Authentication in Rest portlet

RE: Best method for Authentication in Rest portlet

2020-01-11T06:42:22Z

Thanks dear David.
Assume I have a React app that I want to authorize it by PKCE method.
Now, I want to create a new OAuth 2 Application for this , what Client Profile should I choose?
PKCE only exist in User Agent Application, Native Application and Other , but I have a problem when I choose one of this client profiles on saving new OAuth application I get this Error:

Grant type "PKCE Extended Authorization Code" is unsupported for this client type.

RE: Best method for Authentication in Rest portlet

2020-01-02T14:00:53Z

React native is nothing special, it does not preclude using PKCE at all. If you google for "react native pkce" you'll get a bunch of hits for implementation details, including https://formidable.com/blog/2018/oauth-and-pkce-with-react-native/ but there are a bunch of other options too.

RE: Best method for Authentication in Rest portlet

2020-01-02T11:26:04Z

You need to create a client id and client secret from control panel->oauth2administration and share that with react app and mobile app .

RE: Best method for Authentication in Rest portlet

2020-01-02T11:11:20Z

How can I find client id and client secret in my React App or my Mobile App ?
My user only have his username and password and

RE: Best method for Authentication in Rest portlet

2020-01-02T10:13:21Z

Hi ,OAuth 2.0 would suit you , first you send a request with client id and client secret and get the access token and then use access token for processing the following requests

RE: Best method for Authentication in Rest portlet

2020-01-02T08:16:45Z

But this is not a principles and satisfying solution, opening a popup window its not a lovely solution.
On the other hand assume I want to use React Native as my interface, It is certainly not possible to open a window in that environment.
Liferay doesn't have a solid way to do it?

RE: Best method for Authentication in Rest portlet

2019-12-30T15:49:50Z

Hi Vahid, I am guessing you have a decoupled frontend React or Angular app which you want to connect to a REST api you developed. Have you looked at David Nebinger's blog https://liferay.dev/blogs/-/blogs/liferay-oauth-2-0-authorization-flows. I think the PKCE section might be of interest to you. I wouldn't say JWT is a login approach though maybe you can describe more about what you mean.

RE: Best method for Authentication in Rest portlet

2019-12-30T08:31:56Z

We usually require the user to authenticate normally in LIferay and sent the session cookie to the backend with each request. Then you get the user automatically. But I see, for you it is different.

Is OAuth 2.0 an option? I think, this works only in 7.1+, for 7.1 maybe even EE only.

https://portal.liferay.dev/docs/7-1/deploy/-/knowledge_base/d/authorizing-account-access-with-oauth2

RE: Best method for Authentication in Rest portlet

2019-12-30T06:17:08Z

I have a rest module in my Liferay as my backend, at other side as frontend, I have a full React or Angular App (No React or Angular as portlet) that must communicate with my rest module, everything is OK but,
How can I authorize client request by username and password for Role and Permission , In fact I want a approach for login like JWT

RE: Best method for Authentication in Rest portlet

2019-12-29T16:27:51Z

Could you be a bit more specific? What is your usecase? What are you trying to do?

Best method for Authentication in Rest portlet

2019-12-28T06:05:15Z

Hello
What is the best method for Authentication in Rest portlet ?