<div dir="ltr"><div><div>Hmm.. ok.<br><br></div>I actually do need my phone to authenticate to the API. I'm not sure I understand OAuth scopes, or how they relate to FxA.<br><br></div><div>I think what I want is to create a 'mozstumbler' scope which has read-only access to email address. When nicknames are supported, I'd like to have read/write access to that as well. I'm currently using `profile:email` as my scope.<br><br>The part I'm confused about is how to create a new scope.<br><br>I don't see how to do that in the OAuth dashboard over at : <a href="https://oauth-stable.dev.lcip.org/console/login">https://oauth-stable.dev.lcip.org/console/login</a><br><br>The docs don't seem to point to how to create a new scope, and it seems to indicate that I can't create a new scope.<br><br><a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction</a><br></div><div><ul><li><strong>scope</strong> - the requested scope of FxA user data or API access. Currently, only <strong>profile</strong> and related sub-scopes (e.g., <strong>profile:email</strong>) are supported.</li></ul><p>To be honest - I don't really understand why I need a new scope for devices. I think I have a gap in my understanding of what the scope is supposed to do other than restrict access to profile data.<br></p></div><div>vic<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 1, 2015 at 1:17 PM, Christopher Karlof <span dir="ltr"><<a href="mailto:ckarlof@mozilla.com" target="_blank">ckarlof@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><span class="">On Fri, May 29, 2015 at 12:59 PM, Victor Ng <span dir="ltr"><<a href="mailto:vng@mozilla.com" target="_blank">vng@mozilla.com</a>></span> wrote:<br></span><div class="gmail_extra"><div class="gmail_quote"><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Doh. I didn't notice the reply-to doesn't go to the mailing list....<br><br>----<br><br></div><div>Thanks Remy!<br></div><div><br></div>I've got a client that seems to login
now. I get a code, I pass that into my EC2 box and in the end I end up
getting a JSON blob with a bearer token.<br><br>I'm doing something wrong when I try to fetch the user profile though. I'm doing something like this:<br><br>curl -v \<br> -H "Authorization: Bearer c004f4d49008326dc873f0d19eef9ee371c788bea0b888fb7aafa422e1d72d30" \<br> "<a href="https://oauth-stable.dev.lcip.org/v1/profile" target="_blank">https://oauth-stable.dev.lcip.org/v1/profile</a>"<br><br></div><div>Can I use that bearer token from both my phone *and* my EC2 box? How long can I expect the token to be valid for? <br><br></div></div></blockquote><div><br></div></span><div>Yes, you can use this token for talking to the FxA API from both the phone and the EC2 box. These tokens currently live indefinitely (until revoked), but we’re re-working the policies around this. </div><div><br></div><div>This token is not appropriate for authenticating a phone to *your API*, unless it has an OAuth scope associated with it for your service. That’s something worth considering, though (i.e., adding a scope for your API), because then you wouldn’t need an additional authentication mechanism. </div><div><br></div><div>-chris</div><div><div class="h5"><div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div></div>vic<div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 20, 2015 at 3:58 AM, Rémy Hubscher <span dir="ltr"><<a href="mailto:rhubscher@mozilla.com" target="_blank">rhubscher@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Hello Vic,<br>
<br>
So basically all you want to do is to get the user id after the
login, is that right?<br>
<br>
If I get it right, all you have to do is to register a client to
Firefox Account (you can do it yourself for development here:
<a href="https://oauth-stable.dev.lcip.org/console/clients" target="_blank">https://oauth-stable.dev.lcip.org/console/clients</a> (log with a
@<a href="http://mozilla.com" target="_blank">mozilla.com</a> email))<br>
<br>
<br>
All the steps are defined here:
<a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction" target="_blank">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction</a><br>
<br>
The login flow is the following:<br>
<br>
<ol>
<li>You open a browser view with the Firefox Account login page
asking for a list of scopes (in your case it might be <b>mozstumbler</b>)
If you need the email you may ask <b>profile:email</b> as well</li>
<ol>
<li>You give a <b>state</b>, the <b>scope</b>s and your <b>client_id</b></li>
<li>See
<a href="https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#get-v1authorization" target="_blank">https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#get-v1authorization</a><b><br>
</b></li>
</ol>
<li>Then the user logs in and is redirected to your service with a
<b>code</b> and a <b>state</b> (a session that you gave him)</li>
<li>Then you talk to the Firefox Account server to exchange this
code and state with a access token.</li>
<ol>
<li>See
<a href="https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token" target="_blank">https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token</a><br>
</li>
</ol>
<li>This bearer token give you access to the FxA user id as well
as the email if you need it.</li>
<ol>
<li><a href="https://github.com/mozilla/fxa-profile-server/blob/master/docs/API.md#get-v1email" target="_blank">https://github.com/mozilla/fxa-profile-server/blob/master/docs/API.md#get-v1email</a><br>
</li>
</ol>
<li>You must also validate that this Bearer token have got the <b>mozstumbler</b>
scope<br>
</li>
</ol>
<br>
Since you are in an Android app, you will need to setup a redirect
url that will be catched by your app after the login so that you get
back the code and state and can handle them. (See
<a href="http://stackoverflow.com/a/2958870/186202" target="_blank">http://stackoverflow.com/a/2958870/186202</a>)<br>
<br>
Hope this helps you,<br>
<br>
Rémy<div><div><br>
<br>
<br>
<div>Le 19/05/2015 22:16, Victor Ng a
écrit :<br>
</div>
</div></div><blockquote type="cite"><div><div>
<div dir="ltr">
<div>
<div>Hi!<br>
<br>
</div>
We'd like to look at getting FxA integration into the mozilla
stumbler, but I'm pretty confused as to what I actually need
to do.<br>
<br>
</div>
<div>The use case we have is that we are launching localized
leaderboards. Basically - geographically scoped score
boards. <br>
<br>
The intent here is to login to the mobile application - not a
particular web service.<br>
</div>
<div><br>
</div>
<div>The name of our app is "Mozilla Stumbler"<br>
<br>
We're running our dev leaderboard instance on : <a href="http://ec2-52-1-93-147.compute-1.amazonaws.com" target="_blank">ec2-52-1-93-147.compute-1.amazonaws.com</a>
, we can set the redirect_uri to whatever makes sense or is
defacto standard for FxA.<br>
<br>
</div>
<div><br>
</div>
<div>thanks!<br>
</div>
vic<br>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><span><pre>_______________________________________________
Dev-fxacct mailing list
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a>
</pre>
</span></blockquote>
<br>
</div>
<br>_______________________________________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
<br></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>