OAuth2 client server authentication for command line utility
I am working on a command line utility that requires access to backend server via REST API.
I am trying to avoid implementing my own authentication mechanism and use one (or more) public authorization services (e.g. Google, Facebook, Amazon).
I'm trying to get a client to accept credentials and authenticate against an authentication provider, and do so without asking the user to open a web browser and provide a token back. The client will be open source to avoid trust issues (i.e. user credentials are not sent to my backend server).
I'm not interested in authorization, I only need to authenticate to my backend server, without the user having another set of credentials (and not sending the user's credentials to my backend server).
How can I authenticate my client with the auth provider and get a token to communicate with my server without using a web browser?
source to share
I understand you said "don't open the web browser", but what about if this browser is on another device (like their mobile device?).
If applicable, you can use the OAuth 2.0 device approach , whereby you present the user with a short alphanumeric code that they enter at http://google.com/device to authenticate a request from another device. This OAuth flow is designed to work in non-browser environments (like the command line).
To see a demo of this authentication flow in action, go to the YouTube TV site , press the ← key on your keyboard, and select Sign B.
It's also easy to try yourself - create an OAuth client in the console (like "installed app" → "other") and follow the examples curl
in the docs (be sure to replace the demo code
in the token request with the device_code
one received from the original request to the code endpoint). Decode the resulting id_token using any of the JWT decoder examples like this one .
In your case, you have to request a scope profile
that will return id_token
in response to the call to the token endpoint from which you can extract the google user profile id (id field sub
).
source to share