Using OAUTH Tokens with REST Interfaces

[garyopela]

I had recently written an integration between service-now and one of our in-house project management tools. The purpose of this integration was to pull in funding data.

We got to the point where we needed to secure it. My only option was to use OAUTH Tokens, as that is the way the REST services which I were consuming were configured to allow for security.

I already had an end point set up that worked well. I had set up the end point, and then specifically the 'get' function of the REST Message. After speaking with the architects who developed the REST endpoint which I was consuming, they said it was simple to authenticate. All I needed to do was to, in the REST Message Header, pass the phrase: "Authentication : Bearer <token>" where token was generated at the time of the call.

To get the token, I had to make another REST call to the endpoint which generated the token. So now I had two endpoints.

1. REST Message to grab the token:
   1. Name: Get Token
   2. REST endpoint: <Endpoint of the token generator>
   3. Use basic auth: <blank>
   4. REST Message Headers: <blank>
   5. REST Message Functions:
      1. post
         1. REST endpoint: <Endpoint of the token generator>
         2. Use basic auth: <blank>
         3. Lock: <blank>
         4. Use MID Server: <Mid-server I'm using>
         5. REST Message Function Headers
            1. Name: Content-Type
            2. Value: application/json
         6. Content: {"username":"<user>","password":"<password>"}
2. REST Message to actually pull the data in:
   1. Name: Get Data
   2. REST endpoint: <Endpoint of the data pull>
   3. Use basic auth: <blank>
   4. REST Message Headers: <blank>
   5. REST Message Functions:
      1. get
         1. REST endpoint: <Endpoint of the data pull>
         2. Use basic auth: <blank>
         3. Lock: <blank>
         4. Use MID server: <Mid-server I'm using>
         5. REST Message function headers
            1. Name: Authorization
            2. Value: ${token}

Now that I have my endpoints worked out, it's time to set up the code. I was using a scheduled job to do a batch pull every morning of the data.

First, you need to create a function which will return the token when called:

function getToken(){
       var r = new RESTMessage('Get Token', 'post');
       var response = r.execute();

       var k = 1;
       while (response == null){
               response = r.getResponse(1000);
               k++;

               if (k>60){
                       gs.log("Failed to get token in a timely manner.");
                       return;
               }
       }

       var jsonString = response.getBody();
       var parser = new JSONParser();
       var parsed = parser.parse(jsonString);

       var token = parsed.data.access_token;
       return ("Bearer " + token);
}

Now once we have a nice function set up to easily return a token, we can simply do our normal REST call, making sure to pass in the token:

function updateData(pplCode){
       var token = getToken();
       var r = new RESTMessage('Get Data', 'get');
       r.setStringParameter('num', pplCode);
       r.setStringParameter('token', token); //here is where you pass the token
       var response = r.execute();

       var k = 1;
       while (response == null){
               response = r.getResponse(1000);
               k++;

               if (k>60){
                       gs.log('Data Loader ran too long trying to pull back data for: ' + pplCode);
                       return;
               }
       }

       var jsonString = response.getBody();
       var parser = new JSONParser();
       var parsed = parser.parse(jsonString);

       var arg1 = parsed.data[0].firstField;
       var arg2 = parsed.data[0].secondField;
}

Now we are able to generate a token based off of a service account, then use that token in the next REST call. I set up my code to generate a new token each time, and then use that token whenever it needs to do the next REST call.

[Chandan23]

Nice blog

[garyopela]

Thanks!