Request access token

Overview

You authenticate in Sitefinity CMS OData RESTful API services by acquiring a bearer token and sending it with all requests to the OData services. This article describes the following ways that you can use authenticate in Sitefinity CMS to interact with protected OData routes:

  • Using the OpenID authentication protocol
  • Using the Default authentication protocol

Before sending the request to the server, you have to configure Sitefinity CMS advanced settings. Afterwards, you can request a bearer token.

OpenID authentication protocol settings

  1. In Sitefinity CMS backend, navigate to Administration » Settings » Advanced.
  2. In the left pane, expand Authentication » SecurityTokenService » IdentityServer.
  3. Click Clients » Create new.
  4. Fill out the required fields.
    For example, enter the following:
    1. In Client name, enter testApp
    2. In Client Id, enter testApp
    3. Select Enabled checkbox.
    4. In Client flow dropdown box, select ResourceOwner.
    5. Select Allow access to all scopes checkbox.
    6. Save your changes.
  5. Expand the newly created client.
  6. Click Client secrets » click Create new.
  7. Enter a secret and save your changes.
    For example, enter secret
  8. Expand the newly created client.
  9. Click Allow cors origins » Create new.
  10. Enter the origin that can request tokens from the STS.
    For example, enter the URL of your server or app, or * for all.

    IMPORTANT: Allowing access control to all is considered a security risk.

  11. Save your changes.
  12. Expand Authentication » SecurityTokenService » IdentityServer.
  13. Click Scopes » Create new.
  14. In Scope name, enter offline_access
  15. In Scope type, enter Resource
  16. Save your changes.
  17. Restart your Sitefinity CMS instance.

NOTE: If you are in load balanced environment, make sure to apply these steps to all necessary nodes.

Request a bearer token with OpenID protocol

If you are using OpenID authentication protocol to authenticate to a RESTful API service, use the following request to obtain a bearer token that you can afterwards in in subsequent requests.

Sample request

POST http://mysite.com/Sitefinity/Authenticate/OpenID/connect/token

Sample response

Default authentication protocol settings

  1. In Sitefinity CMS backend, navigate to Administration » Settings » Advanced.
  2. In the left pane, expand Security.
  3. In AccessControlAllowOrigin, enter the URL of your server or app, or enter * for all.

    IMPORTANT: Allowing access control to all is considered a security risk.

  4. Save your changes.
  5. In the left pane, expand Authentication » OAuthServer.
  6. Click AuthorizedClients » Create new.
  7. Fill out the required fields.
    For example, enter the following:
    1. In ClientId, enter postman
    2. In Secret, enter secret
  8. Save your changes.
  9. Restart your Sitefinity CMS instance.

NOTE If you are in load balanced environment, make sure to apply these steps to all necessary nodes.

Request a bearer token with the Default protocol

If you are using Default authentication protocol to authenticate to a RESTful API service, use the following request to obtain a bearer token that you can afterwards in in subsequent requests.

Sample request

POST http://mysite.com/sitefinity/oauth/token

Sample response

Use the bearer token in a request

Once you have obtained the bearer token, you must append it to all requests that require authentication as a request header in the following way:

Authorization: Bearer {{token_value}}

Increase your Sitefinity skills by signing up for our free trainings. Get Sitefinity-certified at Progress Education Community to boost your credentials.

Web Security for Sitefinity Administrators

The free standalone Web Security lesson teaches administrators how to protect your websites and Sitefinity instance from external threats. Learn to configure HTTPS, SSL, allow lists for trusted sites, and cookie security, among others.

Foundations of Sitefinity ASP.NET Core Development

The free on-demand video course teaches developers how to use Sitefinity .NET Core and leverage its decoupled architecture and new way of coding against the platform.

Was this article helpful?