• Resource Owner: end-user with resources: Flux, Reflexion, etc on WI-DataCenter Plateform
• Resource Server: WAPI api.wit-datacenter.com accept and respond to protected resources requests using access token
• Authorization Server: WIT-DataCenter authorization server developer.wit-datacenter.com issue access token to the client after successfully authenticating the resource owner and obtaining authorization
• Client: your Application making WAPI requests on behalf of the resource owner and with its authorization. Client does not imply any particular implementation characteristics: can be web server, native Android, IOS or Windows or batch script...

Code Workflow (= OAuth 2.0 Authorization Code Grant)

• Native Apps: IOs, Android or Windows 8/Phone
• Web Apps server side code

1. Redirect users from your App to WIT-DataCenter Authorization Server :

   https://developer.wit-datacenter.com/oauth/authorize?
                       client_id=[YOUR_CLIEND_ID]&                   
                       response_type=code&
                       redirect_uri=[YOUR_REGISTERED_REDIRECT_URI]&
                       scope=https://api.wit-datacenter.com
               

   Take care to set:
   • client_id segment by replacing [YOUR_CLIEND_ID] keyword with your App ClientID.
   • redirect_uri segment by replacing [YOUR_REGISTERED_REDIRECT_URI] keyword with your App callback URL.
   • Leave other segments unchanged
   Warning

   For security reasons, YOUR_REGISTERED_REDIRECT_URI must be in same domain as defined in your App Callback property.
   Example: if you defined a callback with http://www.myapp.com then YOUR_REGISTERED_REDIRECT_URI can be http://www.myapp.com/wapicallbackmangement but not http://www.myapp2.com

2. User authenticate on WIT-DataCenter Identity Provider (or WIP) and then autorize (or NOT) App to access your resources on WIT-DataCenter Authorization Server
   
   
3. User is then redirect on Callback url you haved defined in YOUR_REGISTERED_REDIRECT_URI with a temprorary CODE in URL QueryString:

   https://YOUR_REGISTERED_REDIRECT_URI/?code=CODE

4. App request definitive autorization token in exchange of temporary CODE above. App request with POST :

   POST https://developer.wit-datacenter.com/oauth/token HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
       client_id=[YOUR_CLIEND_ID]&
       client_secret=[YOUR_CLIEND_SECRET]&  
       grant_type=authorization_code&
       redirect_uri=[YOUR_REGISTERED_REDIRECT_URI]&
       code=[CODE]
               

   Remarks

   You can test command with CURL:

   curl -k -d "client_id=[YOUR_CLIEND_ID]&client_secret=[YOUR_CLIEND_SECRET]&grant_type=authorization_code&code=[CODE]&redirect_uri=[YOUR_REGISTERED_REDIRECT_URI]" https://developer.wit-datacenter.com/oauth/token

5. JSON reponse is an autorization token wich contains access_token and other properties:

       { access_token: ACCESS_TOKEN;
         token_type: bearer;
         expires_in: SECOND;  
         callback: YOUR_REGISTERED_REDIRECT_URI;
         refresh_token: REFRESH_TOKEN;
         scope: SCOPE_ALLOWED }

   Reponse properties are:

   Property	Description
   access_token	Access token used to call WAPI opearations
   token_type	Type de Token: always bearer
   expires_in	Access Token validity duration in seconds. When your App receive autorization token, you must add this duration to current time to know absolute expiration date.
   refresh_token	Allow access token refresh when expiration occur Refresh Token.
   scope	Autorization scope allowed by user. To this day, user can access all WIT-Datacenter Plateform features in limit of their Roles in Account Manager notably Way of functuioning should change in next roadmap and we will bring some preciseness about App restriction and scope.Until this returned value is https://api.wit-datacenter.com

   
   
6. App have now to store autorization token for future use: access_token and related properties in your App user store:
   • For a native App: can be in local cache
   • For a Web App: can be in user related database table
     Remark

     To store autorization token, user must be identified. You can define a login page or create user account form on App callback url to associate autorization token with your user.

   
   

Token Workflow (= OAuth 2.0 Implicit Grant)

1. As Code Workflow, redirect users on WIT-DataCenter Authorization Server but response_type value is now token.

   https://developer.wit-datacenter.com/oauth/authorize?
                       client_id=YOUR_CLIEND_ID&                   
                       response_type=token&
                       redirect_uri=YOUR_REGISTERED_REDIRECT_URI&
                       scope=YOUR_SCOPE
                       [YOUR_SCOPE] = https://api.wit-datacenter.com
                   

2. User is then redirect on Callback url you haved defined in YOUR_REGISTERED_REDIRECT_URI with an access_token and expires_in in URL QueryString:

   http://YOUR_REGISTERED_REDIRECT_URI/#token_type=bearer&access_token=ACCESS_TOKEN&scope=SCOPE&expires_in=SECOND
                   

   Returned properties in QueryString are:

   Properties	Description
   access_token	Access token used to call WAPI opearations
   expires_in	Access Token validity duration in seconds
   scope	Autorization scope allowed by user

Credential Workflow (= OAuth 2.0 Resource Owner Password Credentials Grant )

1. Your App must POST to retreive an authorization:

   POST https://developer.wit-datacenter.com/oauth/token HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
       client_id=[YOUR_CLIEND_ID]&
       client_secret=[YOUR_CLIEND_SECRET]&  
       grant_type=password&
       redirect_uri=[YOUR_REGISTERED_REDIRECT_URI]&
       username=[YOUR_WITID]&
       password=[YOUR_PASSWORD]&
       scope=[YOUR_SCOPE]
               

2. JSON response is same as Code Workflow

Client Workflow (= OAuth 2.0 Client Credentials Grant)

1. Your App must POST to retreive an authorization token:

   POST https://developer.wit-datacenter.com/oauth/token HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
       client_id=[YOUR_CLIEND_ID]&
       client_secret=[YOUR_CLIEND_SECRET]&  
       grant_type=client_credentials& 
       scope=[YOUR_SCOPE]
               

2. JSON response is same as Code Workflow

1. Add oauth_token=ACCESS_TOKEN et format=JSON (or other format) to request:

   GET https://api.wit-datacenter.com//[WAC]/flux/[FLUXID]?access_token=[YOUR_ACCESS_TOKEN]&format=JSON

2. Or (better) define access_token in HTTP header with Authorization: Bearer and format application/json (or other format) in HTTP header Content-Type:

   GET /[WAC]/flux/[FLUXID] HTTP/1.1
                       Authorization: Bearer [YOUR_ACCESS_TOKEN]
                       Content-Type: application/json
                       Host: https://api.wit-datacenter.com/
                   

• App refresh autorization token by performing this POST on WIT-DataCenter Authorization Server

  POST https://developer.wit-datacenter.com/oauth/token HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
      client_id=[YOUR_CLIEND_ID]&
      client_secret=[YOUR_CLIEND_SECRET]&
      grant_type=refresh_token&
      refresh_token=[YOUR_REFRESH_TOKEN]
                 

  Remarks

  You can test command with CURL:

  curl -k -d "client_id=[YOUR_CLIEND_ID]&client_secret=[YOUR_CLIEND_SECRET]&grant_type=refresh_token&refresh_token=[YOUR_REFRESH_TOKEN]" https://developer.wit-datacenter.com/oauth/token
                          

• JSON response is same as Code Workflow.