Tcl
Tcl
ING Open Banking OAuth2 Client Credentials
See more OAuth2 Examples
Demonstrates how to get an access token for the ING Open Banking APIs using client credentials.Chilkat Tcl Downloads
load ./chilkat.dll
set success 0
# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.
set cert [new_CkCert]
set success [CkCert_LoadFromFile $cert "qa_data/certs_and_keys/ING/example_client_tls.cer"]
if {$success == 0} then {
puts [CkCert_lastErrorText $cert]
delete_CkCert $cert
exit
}
set bdPrivKey [new_CkBinData]
set success [CkBinData_LoadFile $bdPrivKey "qa_data/certs_and_keys/ING/example_client_tls.key"]
if {$success == 0} then {
puts "Failed to load example_client_tls.key"
delete_CkCert $cert
delete_CkBinData $bdPrivKey
exit
}
# The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd.
# Please note down this client_id since you will need it in the next steps to call the API.
set privKey [new_CkPrivateKey]
set success [CkPrivateKey_LoadAnyFormat $privKey $bdPrivKey ""]
if {$success == 0} then {
puts [CkPrivateKey_lastErrorText $privKey]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
exit
}
# Associate the private key with the certificate.
set success [CkCert_SetPrivateKey $cert $privKey]
if {$success == 0} then {
puts [CkCert_lastErrorText $cert]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
exit
}
set http [new_CkHttp]
set success [CkHttp_SetSslClientCert $http $cert]
if {$success == 0} then {
puts [CkHttp_lastErrorText $http]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
exit
}
# Calculate the Digest and add the "Digest" header. Do the equivalent of this:
# payload="grant_type=client_credentials"
# payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
# digest=SHA-256=$payloadDigest
set crypt [new_CkCrypt2]
CkCrypt2_put_HashAlgorithm $crypt "SHA256"
CkCrypt2_put_EncodingMode $crypt "base64"
set payload "grant_type=client_credentials"
set payloadDigest [CkCrypt2_hashStringENC $crypt $payload]
# Calculate the current date/time and add the Date header.
# reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")
set dt [new_CkDateTime]
CkDateTime_SetFromCurrentSystemTime $dt
# The desire date/time format is the "RFC822" format.
CkHttp_SetRequestHeader $http "Date" [CkDateTime_getAsRfc822 $dt 0]
# Calculate signature for signing your request
# Duplicate the following code:
# httpMethod="post"
# reqPath="/oauth2/token"
# signingString="(request-target): $httpMethod $reqPath
# date: $reqDate
# digest: $digest"
# signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`
set httpMethod "POST"
set reqPath "/oauth2/token"
set sbStringToSign [new_CkStringBuilder]
CkStringBuilder_Append $sbStringToSign "(request-target): "
CkStringBuilder_Append $sbStringToSign $httpMethod
CkStringBuilder_ToLowercase $sbStringToSign
CkStringBuilder_Append $sbStringToSign " "
CkStringBuilder_AppendLine $sbStringToSign $reqPath 0
CkStringBuilder_Append $sbStringToSign "date: "
CkStringBuilder_AppendLine $sbStringToSign [CkDateTime_getAsRfc822 $dt 0] 0
CkStringBuilder_Append $sbStringToSign "digest: SHA-256="
CkStringBuilder_Append $sbStringToSign $payloadDigest
set signingPrivKey [new_CkPrivateKey]
set success [CkPrivateKey_LoadPemFile $signingPrivKey "qa_data/certs_and_keys/ING/example_client_signing.key"]
if {$success == 0} then {
puts [CkPrivateKey_lastErrorText $signingPrivKey]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
delete_CkCrypt2 $crypt
delete_CkDateTime $dt
delete_CkStringBuilder $sbStringToSign
delete_CkPrivateKey $signingPrivKey
exit
}
set rsa [new_CkRsa]
set success [CkRsa_UsePrivateKey $rsa $signingPrivKey]
if {$success == 0} then {
puts [CkRsa_lastErrorText $rsa]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
delete_CkCrypt2 $crypt
delete_CkDateTime $dt
delete_CkStringBuilder $sbStringToSign
delete_CkPrivateKey $signingPrivKey
delete_CkRsa $rsa
exit
}
CkRsa_put_EncodingMode $rsa "base64"
set b64Signature [CkRsa_signStringENC $rsa [CkStringBuilder_getAsString $sbStringToSign] "SHA256"]
set sbAuthHdrVal [new_CkStringBuilder]
CkStringBuilder_Append $sbAuthHdrVal "Signature keyId=\"e77d776b-90af-4684-bebc-521e5b2614dd\","
CkStringBuilder_Append $sbAuthHdrVal "algorithm=\"rsa-sha256\","
CkStringBuilder_Append $sbAuthHdrVal "headers=\"(request-target) date digest\","
CkStringBuilder_Append $sbAuthHdrVal "signature=\""
CkStringBuilder_Append $sbAuthHdrVal $b64Signature
CkStringBuilder_Append $sbAuthHdrVal "\""
set sbDigestHdrVal [new_CkStringBuilder]
CkStringBuilder_Append $sbDigestHdrVal "SHA-256="
CkStringBuilder_Append $sbDigestHdrVal $payloadDigest
# Do the following CURL statement:
# curl -i -X POST "${httpHost}${reqPath}" \
# -H 'Accept: application/json' \
# -H 'Content-Type: application/x-www-form-urlencoded' \
# -H "Digest: ${digest}" \
# -H "Date: ${reqDate}" \
# -H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
# -d "${payload}" \
# --cert "${certPath}tlsCert.crt" \
# --key "${certPath}tlsCert.key"
set req [new_CkHttpRequest]
CkHttpRequest_AddParam $req "grant_type" "client_credentials"
CkHttpRequest_AddHeader $req "Accept" "application/json"
CkHttpRequest_AddHeader $req "Date" [CkDateTime_getAsRfc822 $dt 0]
CkHttpRequest_AddHeader $req "Digest" [CkStringBuilder_getAsString $sbDigestHdrVal]
CkHttpRequest_AddHeader $req "Authorization" [CkStringBuilder_getAsString $sbAuthHdrVal]
CkHttpRequest_put_HttpVerb $req "POST"
CkHttpRequest_put_ContentType $req "application/x-www-form-urlencoded"
set resp [new_CkHttpResponse]
set success [CkHttp_HttpReq $http "https://api.sandbox.ing.com/oauth2/token" $req $resp]
if {$success == 0} then {
puts [CkHttp_lastErrorText $http]
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
delete_CkCrypt2 $crypt
delete_CkDateTime $dt
delete_CkStringBuilder $sbStringToSign
delete_CkPrivateKey $signingPrivKey
delete_CkRsa $rsa
delete_CkStringBuilder $sbAuthHdrVal
delete_CkStringBuilder $sbDigestHdrVal
delete_CkHttpRequest $req
delete_CkHttpResponse $resp
exit
}
# If successful, the status code = 200
puts "Response Status Code: [CkHttpResponse_get_StatusCode $resp]"
puts [CkHttpResponse_bodyStr $resp]
set json [new_CkJsonObject]
CkJsonObject_Load $json [CkHttpResponse_bodyStr $resp]
CkJsonObject_put_EmitCompact $json 0
puts [CkJsonObject_emit $json]
# A successful response contains an access token such as:
# {
# "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
# "expires_in": 905,
# "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
# "token_type": "Bearer",
# "keys": [
# {
# "kty": "RSA",
# "n": "3l3rdz4...04VPkdV",
# "e": "AQAB",
# "use": "sig",
# "alg": "RS256",
# "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
# }
# ],
# "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
# }
# Use this online tool to generate parsing code from sample JSON:
# Generate Parsing Code from JSON
set access_token [CkJsonObject_stringOf $json "access_token"]
set expires_in [CkJsonObject_IntOf $json "expires_in"]
set scope [CkJsonObject_stringOf $json "scope"]
set token_type [CkJsonObject_stringOf $json "token_type"]
set client_id [CkJsonObject_stringOf $json "client_id"]
set i 0
set count_i [CkJsonObject_SizeOfArray $json "keys"]
while {$i < $count_i} {
CkJsonObject_put_I $json $i
set kty [CkJsonObject_stringOf $json "keys[i].kty"]
set n [CkJsonObject_stringOf $json "keys[i].n"]
set e [CkJsonObject_stringOf $json "keys[i].e"]
set use [CkJsonObject_stringOf $json "keys[i].use"]
set alg [CkJsonObject_stringOf $json "keys[i].alg"]
set x5t [CkJsonObject_stringOf $json "keys[i].x5t"]
set i [expr $i + 1]
}
# This example will save the JSON containing the access key to a file so that
# a subsequent example can load it and then use the access key for a request, such as to create a payment request.
CkJsonObject_WriteFile $json "qa_data/tokens/ing_access_token.json"
delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
delete_CkCrypt2 $crypt
delete_CkDateTime $dt
delete_CkStringBuilder $sbStringToSign
delete_CkPrivateKey $signingPrivKey
delete_CkRsa $rsa
delete_CkStringBuilder $sbAuthHdrVal
delete_CkStringBuilder $sbDigestHdrVal
delete_CkHttpRequest $req
delete_CkHttpResponse $resp
delete_CkJsonObject $json