AuthorizationUsernamePassword. All other IAuthorization implementations contain time-sensitive credentials.
Built-in implementations
There are 4 built-inIAuthorization implementations.
Auto-refresh
The SuperOffice WebApi library has limited built-in support to automatically refresh credentials. BothAuthorizationTicket and AuthorizationSystemUserTicket credentials expire after 6 hours, but only AuthorizationSystemUserTicket implements automatic refresh support.
To auto-refresh AuthorizationSystemUserTicket requires the following information:
- Environment
- ContextIdentifier
- ClientSecret
- PrivateKey
- SystemUserToken
AuthorizationAccessToken requires the following information:
- Access Token
- Refresh Token
- Redirect URI
AuthorizationUserToken requires the following information:
- Username
- Password
When is IAuthorization refreshed
This library takes a reactive approach and waits to receive an access denied response before attempting to refresh the Authorization. When an access denied response is received, the client looks to make sure the WebApiOptions has anIAuthorization.RefreshAuthorization implementation. When present and the RefreshAuthorization implementation succeeds, RefreshAuthorization returns an updated IAuthorization.
With an updated Authorization, the client then invokes the IAuthorization.GetAuthorization method to get a two-value tuple, the scheme and the parameter, and uses those to set the Authorization header.
("Bearer", "8A:Cust12345:ABCdefg....XyZ")
Finally, the client retries that original request with an updated scheme and parameter.
Certificate validation
BothAuthorizationAccessToken and AuthorizationSystemUserTicket validate the response from SuperOffice using the SuperOffice public key. The client does this by requesting the OAuth 2.0 metadata document from the online environment. This process takes two requests:
-
The first request is sent to obtain the OAuth 2.0 metadata document, and then extracts the
jwks_uri. -
The second request is sent to the
jwks_urito obtain the certificate details.
Custom IAuthorization implementation
If for some unknown reason you want to populate the Authorization header with a different scheme/parameter values, you can implement your ownIAuthorization. The interface is simple.
ReAuthorizationArgs and returns an IAuthorization instance with updated credential values.
The client updates the WebApiOptions and then calls the GetAuthorization method. GetAuthorization returns the scheme and parameter, which the client then uses to populate the request Authorization header.