Use REST API to execute the Agama Flow

[tatashidayat]

Hi team,
I'm trying to use agama flow and success run the flow, but it needs browser to render the html.
I am wondering is there a way to execute the Agama Flow by using REST API only?

Thanks,
Tatas

[ossdhaval]

Hi @tatashidayat, thanks for visiting Janssen Server discussions .. 🤝

If it is an interactive authentication flow, then you would require a browser. Tagging @yuriyz for confirmation.

You may use automation tools like Selenium or any other to automate the browser agent response.

[yuriyz]

AS supports "OAuth 2.0 for First-Party Native Applications" as well as ROPC which can be used for backchannel authentications.

About Agama as REST API we should ask @jgomer2001 .

[tatashidayat]

Hi @ossdhaval @yuriyz,
thanks for the response.

I'm looking for custom authentication flow (like Agama) that can be invoke via REST API (JSON).

I've tried the Authorization Challenge. But I'm wondering if either use Agama Flow with REST API Json or reuse the flow in Authorizatin Challenge.

[jgomer2001]

by design agama flows are web flows, ie. require a web browser or similar client

...however, there is no restriction on the output's content type of templates - they can produce html, json, text, xml, etc...

so this opens some possibility to go beyond the web browser

If you could provide an example of what you want to achieve, we might give you a deeper insight

[tatashidayat]

Hi @jgomer2001 ,
I have a simple usecase where it will ask the username first then it will generate and send the otp (invoke my internal api).
Ask the user to input otp with max retries 3 times.

But i want to execute fully using REST api and with JSON request and response.

[jgomer2001]

I see. This is possible but requires the implementation of a small http client. Basically it would be a piece of software capable of issuing http requests, parsing json responses, properly dealing with some request/response headers - basically sending cookies (to maintain state) and following the redirects plus handling certain status code errors (like when flows time out, crash, etc).

This is not difficult but requires some understanding of:

• How flows move forward: the so called POST-REDIRECT-GET pattern. In the case of json, the application/json media type would be used instead of the usual application/x-www-form-urlencoded used by web forms
• How to produce json output

Effort varies depending on your skill level. To start, you may like to create a dummy flow for instance that shows 2 pages, one asking your name and the second printing a Hello <name> in the screen. Then try to issue curl commands to make the flow run until it finishes completely. That is, emulating what a browser would do.

If you can deal with that, you can have a better estimate of the amount of work required to code your client.

[nynymike]

For backchannel authn, the right now the best way is to use the Authn Challenge endpoint interception script. This invokes the OAuth First Party Native Authn flow, which is like a backchannel code flow (i.e. multistep interaction which returns a code if successful).

Maybe next year we'll extend Agama to cover the Authn Challenge endpoint.