PowerShell Requires Chilkat v11.0.0+

OAuth2 Token using IdentityServer4 with Client Credentials

See more OAuth2 Examples

Demonstrates how to get an OAuth2 access token using the client credential flow with IdentityServer4. PowerShell

Add-Type -Path "C:\chilkat\ChilkatDotNet47-x64\ChilkatDotNet47.dll"

$success = $false

#  This example assumes the Chilkat API to have been previously unlocked.
#  See Global Unlock Sample for sample code.

$http = New-Object Chilkat.Http

#  The first step is to fetch your IdentityServer4's discovery document
#  (OpenID Connect defines a discovery mechanism, called OpenID Connect Discovery, where an OpenID server publishes its metadata at a well-known URL, 
#  typically https://server.com/.well-known/openid-configuration

$resp = New-Object Chilkat.HttpResponse
$success = $http.HttpNoBody("GET","https://localhost:5000/.well-known/openid-configuration",$resp)
if ($success -eq $false) {
    $($http.LastErrorText)
    exit
}

if ($resp.StatusCode -ne 200) {
    $("Received response status code " + $resp.StatusCode)
    $("Response body containing error text or JSON:")
    $($resp.BodyStr)
    exit
}

$json = New-Object Chilkat.JsonObject
$success = $json.Load($resp.BodyStr)

#  We have the discovery document, which contains something like this:

#  You can use this online tool to generate parsing code from sample JSON: 
#  Generate Parsing Code from JSON

#  {
#    "issuer": "https://localhost:5000",
#    "jwks_uri": "https://localhost:5000/.well-known/openid-configuration/jwks",
#    "authorization_endpoint": "https://localhost:5000/connect/authorize",
#    "token_endpoint": "https://localhost:5000/connect/token",
#    "userinfo_endpoint": "https://localhost:5000/connect/userinfo",
#    "end_session_endpoint": "https://localhost:5000/connect/endsession",
#    "check_session_iframe": "https://localhost:5000/connect/checksession",
#    "revocation_endpoint": "https://localhost:5000/connect/revocation",
#    "introspection_endpoint": "https://localhost:5000/connect/introspect",
#    "frontchannel_logout_supported": true,
#    "frontchannel_logout_session_supported": true,
#    "backchannel_logout_supported": true,
#    "backchannel_logout_session_supported": true,
#    "scopes_supported": [
#      "openid",
#      "profile",
#      "email",
#      "MyCompany.profile",
#      "MyCompany.Identity.WebApi",
#      "MyCompany.TriHub.WebApi",
#      "offline_access"
#    ],
#    "claims_supported": [
#      "sub",
#      "updated_at",
#      "locale",
#      "zoneinfo",
#      "birthdate",
#      "gender",
#      "website",
#      "profile",
#      "preferred_username",
#      "nickname",
#      "middle_name",
#      "given_name",
#      "family_name",
#      "name",
#      "picture",
#      "email_verified",
#      "email",
#      "userId",
#      "groups",
#      "fullname"
#    ],
#    "grant_types_supported": [
#      "authorization_code",
#      "client_credentials",
#      "refresh_token",
#      "implicit",
#      "password"
#    ],
#    "response_types_supported": [
#      "code",
#      "token",
#      "id_token",
#      "id_token token",
#      "code id_token",
#      "code token",
#      "code id_token token"
#    ],
#    "response_modes_supported": [
#      "form_post",
#      "query",
#      "fragment"
#    ],
#    "token_endpoint_auth_methods_supported": [
#      "client_secret_basic",
#      "client_secret_post"
#    ],
#    "subject_types_supported": [
#      "public"
#    ],
#    "id_token_signing_alg_values_supported": [
#      "RS256"
#    ],
#    "code_challenge_methods_supported": [
#      "plain",
#      "S256"
#    ]
#  }
#  

#  The next steps are to (1) get the token_endpoint,
#  and (2) verify that the client_credentials grant type is supported.

$tokenEndpoint = $json.StringOf("token_endpoint")

$grantTypes = $json.ArrayOf("grant_types_supported")
$clientCredentialsIdx = $grantTypes.FindString("client_credentials",$true)

#  If clientCredentialsIdx is less then zero (-1) then the "client_credentials" string was not found.
if ($clientCredentialsIdx -lt 0) {
    $("The client credentials grant type is not supported.")
    exit
}

#  Request the access token using our Client ID and Client Secret.
#  We're going to duplicate this CURL statement:

#  curl --request POST \
#    --url '<tokenEndpoint>' \
#    --header 'content-type: application/x-www-form-urlencoded' \
#    --data 'grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET'

$req = New-Object Chilkat.HttpRequest
$req.HttpVerb = "POST"
$req.ContentType = "application/x-www-form-urlencoded"

$req.AddParam("grant_type","client_credentials")
$req.AddParam("client_id","CLIENT_ID")
$req.AddParam("client_secret","CLIENT_SECRET")$req.HttpVerb = "POST"

$success = $http.HttpReq($tokenEndpoint,$req,$resp)
if ($success -eq $false) {
    $($http.LastErrorText)
    exit
}

#  Make sure we got a 200 response status code, otherwise it's an error.
if ($resp.StatusCode -ne 200) {
    $("POST to token endpoint failed.")
    $("Received response status code " + $resp.StatusCode)
    $("Response body containing error text or JSON:")
    $($resp.BodyStr)
    exit
}

$success = $json.Load($resp.BodyStr)

#  Our JSON response should contain this:
#  {
#    "access_token":"eyJz93a...k4laUWw",
#    "token_type":"Bearer",
#    "expires_in":86400
#  }

#  Get the access token:
$accessToken = $json.StringOf("access_token")

#  The access token is what gets added to "Authorization: Bearer <access_token>"
#  for the subsequent REST API calls..