PKCE grant

PKCE (Proof Key for Code Exchange) authorization code grant is a more secure version of the standard authorization code grant type. To better protect against attacks, the PKCE flow also requires a client generated secret when exchanging the authorization code for the access token. This requirement prevents the access code from being acquired by malicious actors even if the authorization code is intercepted.

To use PKCE authorization code grant:

• Configure the minimum options required for a connection:
  • If you are using a Model file, set the REST Config File (RestConfigFile) option to provide the name and location of the Model file. For example, C:/path/to/box.rest.
  • If you are using the REST Sample Path method, set the REST Sample Path (RestSamplePath) option to specify the endpoint that the want to connect to and sample. For example, https://example.com/countries/.
• Set the Authentication Method (AuthenticationMethod) option to 56 (OAuth2-PKCE).
• Set the Client ID (ClientID) option to specify the client ID key for your application.
• Set the ClientSecret (ClientSecret) option to specify the client secret for your application.
  Note: The client secret is a confidential value used to authenticate the application to the server. To prevent unauthorized access, this value must be securely maintained.
• Set the Authorization URI (AuthURI) option to specify the endpoint for obtaining an authorization code.
• Set the Token URI (TokenURI) option to specify the endpoint used to exchange authentication credentials for access tokens.
  Note: By default, the connector prefixes the token URI endpoint with a GET request method. However, some OAuth implementations require that the token URI endpoint be passed with a POST request method. In this scenario, the token URI endpoint must be prefixed with POST when specifying the value of the TokenURI option. For example: TokenURI=POST https://example.com/oauth2/authorize/.
• Set the Redirect URI (RedirectURI) option to specify the endpoint that the client is returned to after authenticating with a third-party service. Note that the value of the RedirectURI property must include the port number. For example, RedirectURI=http://localhost:80 or RedirectURI=http://localhost:8080.
• Set the SQL Engine Mode (SQLEngineMode) option to 2 (Direct). Note that this is the default setting for Windows.
  Note: The dynamic authorization code grant is supported only in Direct mode.
• Optionally, specify values for a custom HTTP header to be used for authentication, such as those used in tenant ID authentication:
  • Set the Authentication Header (AuthHeader) option to specify the name of the HTTP header used for authentication.

  • Set the Security Token (SecurityToken) option to specify the value of the HTTP header named by the Authentication Header option.

  For example, if you have a header value of Authorization:1a2bc34def567, you would specify a values of AuthHeader=Authorization and SecurityToken=1a2bc34def567.

  Note: You can specify multiple custom HTTP headers using the #headers in the Model file. See "Requests with custom HTTP headers" for details.
• Optionally, set the Scope (Scope) option to specify a space-separated list of OAuth scopes to limit the permissions granted by the access token.
• Optionally, set the OAuth Client Credentials Mode (ClientCredentialsMode) option to determine how client credentials are sent in a request to obtain an access token . Configure this option for flows that require client credentials to be specified as only a basic authentication header or only as a URL parameter.
  • If set to 0 (Default), the client credentials are sent as a basic authentication header. This is the default setting.
  • If set to 1 (Basic), the client credentials are sent as a basic authentication header.
  • If set to 2 (Url), the client credentials are sent as a URL parameter.

  • If set to 3 (Post), the client credentials are sent in the body of a POST request.

• Optionally, specify values for any additional options you want to configure. See "Connection option descriptions" for a complete list of options.

DRIVER=DataDirect 8.0 Autonomous REST Connector;RestConfigFile=C:/path/to/box.rest;
       AuthenticationMethod=56;ClientID='abcdefghik2lmn3o5qr67s';
       ClientSecret=FaZBFRsGXTaR;AuthURI=https://accounts.spotify.com/authorize;
       RedirectURI=https://localhost:8080;
       TokenURI='https://accounts.spotify.com/api/token';SQLEngineMode=2

Driver=ODBCHOME/lib/ivautorestxx.so;
Description=My Autonomous REST Data Source
...
AuthenticationMethod=56
...
AuthURI=https://accounts.spotify.com/authorize
...
ClientID=abcdefghij1k2lmn3o4p5qr67s
...
ClientSecret=FaZBFRsGXTaR
...
RedirectURI=https://localhost:8080
...
RestConfigFile=C:/path/to/spotify.rest
...
SQLEngineMode=2
...
TokenURI=https://accounts.spotify.com/api/token
...