如何仅使用 curl 模拟授权代码流

Question

我知道其他 OIDC / OAuth 流程是为系统到系统的通信而设计的。 我知道通常需要浏览器来获得用户对访问令牌的同意。

这就是为什么这个问题听起来很奇怪： 我希望能够使用授权代码流通过 curl 获取访问令牌。

有什么简单的方法吗？

Answer 1

找到了适合我的方法。离“轻松”更远，离美丽更远：

#!/bin/bash

### define static vars
username=XXXXXX
password=XXXXXX

client_id='XXXXXXXXX'
client_secret='XXXXXXXXX'
# redirect url must match configuration in approval tool
redirect_url='https://THE_CLIENT_REDIRECT_URL/'
auth_url='https://THE_AUTH_URL_HOST/as/authorization.oauth2'
access_token_url='https://THE_ACCESS_TOKEN_HOST/as/token.oauth2'
login_server='https://THE_LOGIN_SERVER' # static in our case, but it should be possible to fetch this as well
scope='openid'

# step 1 get redirect to login server for a client id
curl -s -o 1_getloginpage.html -k --location --cookie mycookiejar.txt --cookie-jar mycookiejar.txt \
"$auth_url?response_type=code&state=&client_id=$client_id&scope=$scope&redirect_uri=$redirect_url"

# step 2 parse resume url and csrf from html output
csrf=$(grep _csrf 1_getloginpage.html | sed s/.*value=\"// | sed 's_"/>__')
pingResume=$(grep 'id="pingResume"' 1_getloginpage.html | sed s/.*value=\"// | sed 's/">//')
echo "csrf is: $csrf"
echo "pingResume is: $pingResume"

# step 3 send login information to login server and dump the headers since they contain a code we need
curl -s --location --dump-header 2_headers.txt -o step2.html -k --cookie mycookiejar.txt --cookie-jar mycookiejar.txt \
--data-urlencode "pingResume=$pingResume" \
--data-urlencode "_csrf=$csrf" \
--data-urlencode "username=$username" \
--data-urlencode "password=$password" \
"$login_server" 

# step 4 parse the code and request the token
code=$(grep code= 2_headers.txt | sed 's/.*code=//' | sed 's/&.*//')
curl -s -o 3_token_response.json -k --location --cookie mycookiejar.txt --cookie-jar mycookiejar.txt \
--data-urlencode "code=$code" \
--data-urlencode "redirect_uri=$redirect_url" \
--data-urlencode "grant_type=authorization_code" \
--data-urlencode "client_id=$client_id" \
--data-urlencode "client_secret=$client_secret" \
"$access_token_url"

token=$(jq .access_token 3_token_response.json | sed 's/"//g')
echo $token

# cleanup
rm 1_getloginpage.html
rm 2_headers.txt
rm 3_token_response.json
rm mycookiejar.txt