Yammer OAuth2 REST authentication always gives same access token for different users -


we developing app, , integrating our app yammer, wanted post our app messages yammer, have office 365 login, , can able login in yammer office 365 account , post messages , not verified admin in yammer.

  1. first, nodejs code calls office 365 authentication
  2. checks in db whether bearer token available authenticated user
  3. if token not available in db, redirects yammer oauth authentication
  4. yammer authentication dialog box appears
  5. logged in user (new user, not registered app), registered in yammer
  6. redirecting access_token rest api
  7. getting duplicate access token https://api.yammer.com/oauth2/access_token rest api, received access token duplicate of user

the problem, why am getting duplicate access token different users, thing have go impersonation, should verified admin user

can help?, in advance.

    var express = require('express');     var passport = require('passport');     var bearertoken = require('express-bearer-token');     var strategy = require('passport-azure-ad-oauth2').strategy;     var path=require('path');     var jwt = require("jwt-simple");     var url = require('url');     var https = require('https');     var fs = require('fs');      var gname="";     var fname="";     var email ="";     var btoken="";     var yammercode = "";     var yammerresponse;     var finalbearertoken = "";      var options = {         key: fs.readfilesync('key.pem'),         cert: fs.readfilesync('certificate.pem'),         requestcert: false,         rejectunauthorized: false     };       var app = express();      app.use(bearertoken());      app.use(passport.initialize());     app.use(express.static(path.join(__dirname, '/src')));      passport.use('office365_oauth2',new strategy({             clientid: 'client id',             clientsecret: 'client secret',             callbackurl: 'https://mycomputer:443/response1',             tokenurl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',             authorizationurl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',               scope: 'user.read',               skipuserprofile:false,               domain_hint:'csc.com'                       },             function (accesstoken, refresh_token, params, profile, done) {               var user = jwt.decode(accesstoken, '', true);                  gname =  user.given_name;                     fname =  user.family_name;                     email =  user.upn;                    btoken = accesstoken;                                  return done(null, user);                            }             ));       passport.serializeuser(function(user, done) {                console.log("profile : ", user);                     done(null, user);         });          passport.deserializeuser(function(user, done) {                   console.log("profile : ", user);                     done(null, user);         });      app.get('/response1', passport.authenticate('office365_oauth2'), function(req,res,next){        res.redirect(url.format({           pathname:"http://mycomputer:3332/",           query: {               "o365": "true",               "userfirstname": gname,               "userlastname": fname,                         "upn": email,               "token":'checkdb'             }         }));         });       app.get('/yammerauth', function(req,res,next) {      res.redirect(url.format({          pathname : "https://www.yammer.com/csc.com/oauth2/authorize",       query : {               "client_id" : "clientid",               "redirect_uri" : "https://mycomputer:443/response2",               "response_type" : "code"        }       }))      });        app.get('/response2', function(req,res,next){      yammercode = req.query.code;      console.log('yammercode ' + yammercode);      if (typeof yammercode != 'undefined')     {         console.log(yammercode);                var postdata={                   client_id : "clientid",                   client_secret : "client_secret",                   code : yammercode,                   grant_type : "authorization_code"               };                require('request').post({                 uri:"https://www.yammer.com/oauth2/access_token",                             body:require('querystring').stringify(postdata)                 },function(err,res1,body){                                 console.log(res.statuscode);                      yammerresponse =   json.parse(body);                      if (typeof yammerresponse != 'undefined'  )                     {                         finalbearertoken = yammerresponse.access_token.token;                          console.log('bearertoken ' + finalbearertoken);                          res.redirect(url.format({                         pathname:"http://mycomputer:3332/",                         query: {                             "o365": "true",                             "userfirstname": gname,                             "userlastname": fname,                                       "upn": email,                             "token": finalbearertoken                           }                       }));                              }                     else                     {                           console.log('bearertoken not generated');                          res.redirect(url.format({                         pathname:"http://mycomputer:3332/",                         query: {                             "o365": "true",                             "userfirstname": gname,                             "userlastname": fname,                                       "upn": email,                             "token":'noauth'                           }                       }));                       };                });        }        else       {             res.redirect(url.format({             pathname:"http://mycomputer:3332/",             query: {                 "o365": "true",                 "userfirstname": gname,                 "userlastname": fname,                           "upn": email,                 "token":'noauth'               }           }));           }      }      )        app.get('/login',passport.authenticate('office365_oauth2'),function(req, res, next){ });      app.get('/logout', (req, res) => {       req.logout();       //res.clearcookie('connect.sid');       res.redirect('http://mycomputer:3332');     });     var httpsserver = https.createserver(options,app);     httpsserver.listen(443);      console.log("listening");


Comments

Post a Comment

Popular posts from this blog

Is there a better way to structure post methods in Class Based Views -

i'm using class based views in django , never specify url in ajax calls , omit action parameter in form because know these requests go through post method of class based view. notice view - profile page make many requests depending on user updating on page - post method become convoluted , if/else mess example: def post(self, request, *args, **kwargs): # handle user changing available date if request.post.get('availabledate') != none: self.updateavailabledate(request) return jsonresponse({'result':'success'}) if request.post.get('newprojectname') != none: creative_user = creativeuserprofile.objects.get(id = request.user.id) project = project.create_project(creative_user, request.post['newprojectname']) project.save() return jsonresponse({'projectid': project.id }) if request.post.get('projectimage') != none , request.files['file']: proj...
Read more

performance - Why is XCHG reg, reg a 3 micro-op instruction on modern Intel architectures? -

i'm doing micro-optimization on performance critical part of code , came across sequence of instructions (in at&t syntax): add %rax, %rbx mov %rdx, %rax mov %rbx, %rdx i thought had use case xchg allow me shave instruction , write: add %rbx, %rax xchg %rax, %rdx however, dimay found agner fog's instruction tables , xchg 3 micro-op instruction 2 cycle latency on sandy bridge, ivy bridge, broadwell, haswell , skylake. 3 whole micro-ops , 2 cycles of latency! 3 micro-ops throws off 4-1-1-1 cadence , 2 cycle latency makes worse original in best case since last 2 instructions in original might execute in parallel. now... cpu might breaking instruction micro-ops equivalent to: mov %rax, %tmp mov %rdx, %rax mov %tmp, %rdx where tmp anonymous internal register , suppose last 2 micro-ops run in parallel latency 2 cycles. given register renaming occurs on these micro-architectures, though, doesn't make sense me done way. why wouldn't register renamer ...
Read more

c# - Asp.net web api : redirect unauthorized requst to forbidden page -

im trying redirect unauthorized request forbidden page instead i'm getting forbidden page in response body , how can fix ? here's startup class : app.createperowincontext(storecontext.create); app.createperowincontext<applicationusermanager>(applicationusermanager.create); app.createperowincontext<applicationsigninmanager>(applicationsigninmanager.create); app.usecookieauthentication(new cookieauthenticationoptions { authenticationtype = defaultauthenticationtypes.applicationcookie, expiretimespan = timespan.fromdays(30), }); app.useexternalsignincookie(defaultauthenticationtypes.externalcookie); app.usetwofactorsignincookie(defaultauthenticationtypes.twofactorcookie, timespan.fromminutes(5)); app.usetwofactorrememberbrowsercookie(defaultauthenticationtypes.twofactorrememberbrowsercookie); the method im trying reach : [httpget] [authorize(roles = "admin")] public string getcurrentusername() { return userman...
Read more