Where do i configure the client_id and client_secret for rest webservices ?

[Former Member]

As described here: https://wiki.hybris.com/display/release5/OAuth+2.0 a call to the oauth token endpoint looks like this:

res = tokenURL.post(deadline: 30, payload:"client_id=${client_id}&client_secret=${client_secret} &grant_type=password&username=${username}&password=${password}".getBytes())

But where do i configure my client_id and client_secret ? With bogus values i get:

{ "errors": [ { "type": "BadClientCredentialsError", "message": "Bad client credentials" } ] }

[christoph_probst · Accepted solution]

you can find the configuration in your extension under web/webroot/WEB-INF/config/common/security-spring.xml. There is a block where the secret is specified. by default client_secret is secret and you can use mobile_android for client_id. The configuration block looks like

         <oauth:client-details-service id="clientDetails">
             <oauth:client client-id="client-side" resource-ids="hybris" scope="basic" authorized-grant-types="implicit,client_credentials"
                 authorities="ROLE_CLIENT" secret="secret" redirect-uri="http://localhost:9001/rest/oauth2_implicit_callback" />
             <oauth:client client-id="mobile_android" resource-ids="hybris" scope="basic"
                 authorized-grant-types="authorization_code,refresh_token,password,client_credentials" authorities="ROLE_CLIENT" secret="secret"
                 redirect-uri="http://localhost:9001/rest/oauth2_callback" />
             <oauth:client client-id="trusted_client" resource-ids="hybris" scope="extended"
                 authorized-grant-types="authorization_code,refresh_token,password,client_credentials" authorities="ROLE_TRUSTED_CLIENT"
                 secret="secret" />
         </oauth:client-details-service>

[Former Member · Accepted solution]

Do I need to restart the hybrisserver after this change or init or anything? Or it is something accepted on runtime?

[former_member626698]

Hi, It's been changed on Hybris 6.x You can write an impex or use backoffice to configure them

You can check [here]

Impex example:

 INSERT_UPDATE OAuthClientDetails;clientId[unique=true]    ;resourceIds       ;scope        ;authorizedGrantTypes                                            ;authorities             ;clientSecret    ;registeredRedirectUri
                                 ;client-side              ;hybris            ;basic        ;implicit,client_credentials                                     ;ROLE_CLIENT             ;secret          ;http://localhost:9001/authorizationserver/oauth2_implicit_callback;
                                 ;mobile_android           ;hybris            ;basic        ;authorization_code,refresh_token,password,client_credentials    ;ROLE_CLIENT             ;secret          ;http://localhost:9001/authorizationserver/oauth2_callback;

Regards,

[1]: https://help.hybris.com/6.4.0/hcd/627c92db29ce4fce8b01ffbe478a8b3b.html

[Former Member]

Thanks shared.

[Former Member]

/hybris/bin/ext-template/ycommercewebservices/web/webroot/WEB-INF/config/security-spring.xml