In the previous lecture, we got an access token by invoking the endpoint to oral humanity hyphen coconut's
last token against our key Glock's over.
So let me try to get the access token one more time, because my previous access token might have expired.
So as you can see in the body, we have to make sure we are passing the claim daily claim, secret scope
and type.
So once we have these details populated and invoke this epper with the post method, you should get
an actor Stockmann.
So I got a new access token here.
I'll take this access token.
And here first, I'll try to invoke this my account API without passing any access token.
You can see I'm getting four zero one unauthorized.
So now in order to pass this access token to my resource, our API, I need to mention and header with
the name authorization and the value will be better space followed by that access token that you got
from the key blocks over.
So with this now, if I try to invoke you can see right now I have four zero one.
But for this, I'm getting four zero three, far below zero, which means amateur indicator.
But I'm not authorized to invoke this.
This is because we have configure in order to invoke my account to pay the client application of the
user should have a role of user, since I have not created any roles and assigned to the client that
I have created on the key block, it is throwing fraudulent error.
But let's try to invoke my.
Because for these only the user should be authenticated and there is no to restrictions.
So if I tried to invoke my loans and in the Bardi also, we should make sure we are passing the email.
And what is the email that we have presented in the database?
As you can see here, I'm getting a two hundred response, which means I pass the access token that
I got from the kik lots over to my resource.
So where when I am invoking a securest API, my resource server went and validated the access token
that is provided by me.
And once it decided it is a valid access token and I have enough authorization to invoke that particular
API, it is giving a proper response to me.
So now my is working because there is no Rawles mapping is needed for that.
But if I invoke the same access token my account as we saw previously, we are getting four zero three
error.
So how to resolve this for the same?
We can go to Google admin console.
Here we have a role.
It's tab.
Click on that.
And by default, we have some predefined roles created.
So I'm trying to create a new role.
And the role name is user.
I'm clicking sale.
Similarly, I will also create one more role, which is admin.
So once I have created these two roles, you can verify that the role names are appearing here.
So I have to map these roles to my client.
I did that.
I have created so far the same.
I just had to go to clients and hear the client is easy bank epper.
Once you click on the client easy bank API, there is a role tab here.
You just have to click on the service account rules, because this is not an individual user.
This is an service account which we are trying to use inside client credentials.
Grant.
So I'll click on this service account rules.
So here we have two available roles, adding both of them to the client ID Easy Bank API.
So now my client Easy Bank API has role access of admin and user.
So if I tried to get the first access token and invoke my account API, it should work without any issues.
So let me try to get the access token again by invoking the same epei slash token.
So this time I got different access token and taking that.
I'll go to the my account AP location tab here and there, dad, I need to replace the access token
with the latest one.
Once I replaced the latest access token, if I tried to invoke, I should get a proper response with
the 200 status.
So you can see I got a successful response.
So at this rate, we can create clanged credentials claim by these roles and assign between them.
And this is the scenario where one microservice, auto one service is trying to invoke other service.
So due to that reason, we have used to claim declensions, grandpap, where there is no individual
user involved.
We can also check about what is present inside this access token by going to the JWT payroll.
So I'm just basing the access token that will resume.
So you can see these are all the details below that my Geekcorps, our responder, my roles are present
inside real access inside that all of my roles are present and are roles key.
If you can recall, we wrote a quick log roll converter here for.
We are looking for the key real access, which is matching to this one.
They got a value for real access.
I will look again for the key roles so that we are doing here.
Once we got the key value of roles, I'm making sure the role is being changed to role, underscore
role name and as all those roles and putting inside grant authority.
And I'm passing all those authorities to my spring security framework.
So this way I wrote a custom converter, which will make sure to do that conversion so that my roles
are being passed to my spring security framework the way it is expecting.
But if you don't want to do that in Sadaf, any role you can use has any authority or has authority,
because inside authority, we learnt there is no prefix of role will be added by spring secuity framework
against that rules that we have configured.
But with this simple rule convertor, we should be good.
Even if you are trying to use the role based access mechanism and you can see these are the scopes supported
by my key, our right not so open it will you access token and ID token and your email, will you email
details and the email, will you email details of the user at the client?
If there are any present inside Keek, log odds over and address.
Will you address details and profile?
Will you profile details?
We can also see whether we are trying to get an access token by invoking the EPA slash token.
We are also getting a dedicated separate AIDY token so we can go and check what is present inside this
I.D. token by pasting that here in the JWT, not able.
And this I.D. token contains and Baddeley the details about the individual user, our client application
who are trying to perform identification and authorization.
So that idees easy bank API here and there is no address.
That's why it is empty.
And we also have other details, like at what time the token is issued, what is the expiration time.
So any details that you want to know specific to the user R identity of the client application?
You can always leverage that idea to open.
So this way, open a framework.
Also, either I token on top of access token.
With this, we have a clear understanding on how to create and climbed on key Glock's or what.
So that we can use that inside client credentials grant type.
Once that is created, we saw how to get an access token by invoking an API against clock.
So what was that?
We also configured a resource server and establish a link between resource server and key glugs.
So by mentioning a property inside application that properties once that is done, we also saw how to
take an access token from the key clerk's hour and password access token to the resource server to get
the proper authenticated response from it.
So this way we cover the first two scenarios, like getting the response from the resource server using
Posman API invocation.
And the same approach can be used for any API to API interaction or service to service interaction in
the next lecture.
Let's try to understand how to implement or to framework in the scenarios where we have an Web application
to interact with them, resource our bank.
You and I'll see you in the next lecture by.