How can I verify a LinkedIn access token?
I need to check if an access token is valid or not?
ex: in Facebook
https://graph.facebook.com/me?access_token=access_token
Is there a similar way to do it in LinkedIn?
I found that it can be done like this:
https://api.linkedin.com/v1/people/~?oauth2_access_token=YOUR-ACCESS-TOKEN
and that's it :).
Additionally, you can filter the values:
https://api.linkedin.com/v1/people/~:(id,first-name,last-name,headline,picture-url,location,industry,current-share,num-connections,summary,specialties,positions)?format=json&oauth2_access_token={0}
You can use Token Introspection to get some informations about the token
https://learn.microsoft.com/en-us/linkedin/shared/authentication/token-introspection?context=linkedin/context
The url has been changed and the v1 API does not work anymore. Do use this one, if you need to verify access tokens generated from Linkedin.
https://api.linkedin.com/v2/me?oauth2_access_token=<your-token-here>
For other social media's, use can use urls from this gist: https://gist.github.com/pavittarx/15b46b08e779c2113864e9db399f35ac
Related
I have a Next.js website with firebase. It takes care of everything I need with authentication. However, In addition to the signInWithPopup, I am also using signInWithEmailAndPassword function in order to let my users authenticate using email and password.
The problem is that signInWithEmailAndPassword sends a request to:
https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=[PUBLIC_KEY]
And it returns a valid response with the authToken. And when I paste the request in Postman, I see that everyone can access this endpoint. How can I protect this route? I want this route to be accessible just from my website.
I saw that there is something called App-Check that can restrict access to API but couldn't find a way to make it work.
Thank you!
I have used,
<OAuthConfig oAuthScope="r_liteprofile r_emailaddress" providerId="LINKED_IN" userProfileUrl="https://api.linkedin.com/v2/me"/>
and using OAuth2 for this but I'm unable retrieve email with this. Is there possibility to get both email & liteprofile from single accesstoken request?
My app is having permissions with
r_liteprofile
r_emailaddress
w_member_social
Can anyone help me with this?
Thanks in advance.
THIS IS THE RESPONSE I'm getting,
THIS IS JSON OBJECT:
{"lastName":{"localized":{"en_US":"global"},"preferredLocale":{"country":"US","language":"en"}},"firstName":{"localized":{"en_US":"Gifting"},"preferredLocale":{"country":"US","language":"en"}},"id":"_Ru_P5gptv"}
net.sf.json.JSONException: JSONObject["emailAddress"] not found.
The email address is available via the /emailAddress API, not the /me API.
You will need to make an additional GET request to https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))
I search for a solution to authtificate using the access token,
The customer sends a link via email https://www.mywebsite.com/?token=ijn8pC5q2bwftM7dMcjkhkdhgkfdjgfdgg type). when the customer click on the link, the applciation should get automatically the token and then redirect the user his personal page,
Any idea please
You can implement this using an custom authentication guard. This well described in the documentation of symfony. In the example they use an http header field, but you can easily use a query parameter to do the same thing.
As Daniel commented, be aware of token invalidation to ensure a secure application.
I will not post any of my code, because this is more just a question to know if it's possible.
I've been googling a lot, but didn't find any concrete solutions. I hope someone can help me here.
The facts:
I have a login form
I need to authenticate the credentials over a web-service
I need to send both username and password, to get back a token if logged in successfully.
The problems:
With a custom provider I'm always stuck with the fact that they only have direct access to the userename, like: loadUserByUsername. I need to access the password there as well, to be able to send this to my web-service.
I have only 1 web-service which sends only back a token if provided username and password are correct.
Question:
How can I access and send both username and password to my web-service?
Thanks!
Generally speaking one would authenticate using an API token to a web service.
That API token is usually issued via an auto-generation script when the user account is created (either by an admin or by a registration form). This token is then passed by the API call to the web-service in a header which then uses it to authenticate the user.
As far as Symfony goes, by far the easiest way of doing this is with Guard. A new component built by Ryan Weaver from KNP.
KNPUniversity has a great tutorial on it (for free).
Note that this is only one option of many, and the 'best' way is probably mainly opinion based and directly related to the use case in question. But it might help you get on the right track.
If the token you want to create should be a JSON Web Token (JWT), a very conventient bundle is LexikJWTAuthenticationBundle, which does almost all of the work automatically. If you just follow the documentation, you will have it quickly up and running. You can combine it with FOSUserBundle, with a custom User entity or whatever.
Is it possible to derive a linkedin profile url (public OR private) from the user ID?
You can use the ID in this URL and this will give you the link to User Profile http://www.linkedin.com/profile/view?id=YourID
UPDATE: Apparently, this solution no longer works.
You need to get r_basicprofile permissions from the user, then grab the public-profile-url field from the response.
read more at https://developer.linkedin.com/docs/fields/basic-profile
I guess some things have changed in the LinkedIn API over the years.
This is the solution that worked for me:
http://www.linkedin.com/in/USERNAME
Used it as a href in my website to link to user's LinkedIn profile page and it works fine.