Skip to main content
Solved

Connect to an api that uses a hashed challenge and verifier (PKCE) as part of the oauth2.0 flow?

  • April 14, 2023
  • 1 reply
  • 81 views
johnglick
Contributor
Forum|alt.badge.img+7

It seems I have no place to force FME to include the code_verifier parameter in the request body to obtain a token (see requirements below). Any ideas of how to work around this in FME? The postman equivalent is selecting the grant type as "Authorization Code (with PKCE)". I can use the same challenge and verifier more than once, just need to include it in the body rather than a querystring.

 

Per the platform's API docs:

Parameters sent in Request Body, Form-URL Encoded. (cannot use JSON or querystring)

code=<code received in callback url>

client_id=<Application OAuth Client ID>

client_secret=<Application OAuth Client Secret>

grant_type=authorization_code

redirect_uri=<User redirect URL (from step 4)>

code_verifier=<User Generated Code Verifier>

 

 

Best answer by desiree_at_safe

Hi ​@johnglick! I came across your post, and I figured a reply would (hopefully) still help you and the community.

But FME actually generates these values for you! - The code verifier and code challenge -


To use PKCE in FME, you just have to set the challenge method - SHA-256 or Plaintext


In most cases, the code verifier length and state length can safely be left at their default values unless the OAuth server’s documentation specifies otherwise. 

Hope this helps! 🙂

    1 reply

    desiree_at_safe
    Safer
    Forum|alt.badge.img+20

    Hi ​@johnglick! I came across your post, and I figured a reply would (hopefully) still help you and the community.

    But FME actually generates these values for you! - The code verifier and code challenge -


    To use PKCE in FME, you just have to set the challenge method - SHA-256 or Plaintext


    In most cases, the code verifier length and state length can safely be left at their default values unless the OAuth server’s documentation specifies otherwise. 

    Hope this helps! 🙂

    Happy FME-ing!

      Community Stats

      32,392
      Posts
      123,118
      Replies
      40,493
      Members
      Terms & ConditionsCookie settingsAccessibility statement
      A product of
      Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.