(Tcl) ING Open Banking OAuth2 Client Credentials

Demonstrates how to get an access token for the ING Open Banking APIs using client credentials.

For more information, see https://developer.ing.com/openbanking/get-started/openbanking

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set cert [new_CkCert]

set success [CkCert_LoadFromFile $cert "qa_data/certs_and_keys/ING/example_client_tls.cer"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

set bdPrivKey [new_CkBinData]

set success [CkBinData_LoadFile $bdPrivKey "qa_data/certs_and_keys/ING/example_client_tls.key"]
if {$success == 0} then {
    puts "Failed to load example_client_tls.key"
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    exit
}

# The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd. 
# Please note down this client_id since you will need it in the next steps to call the API.

set privKey [new_CkPrivateKey]

set success [CkPrivateKey_LoadAnyFormat $privKey $bdPrivKey ""]
if {$success == 0} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    exit
}

# Associate the private key with the certificate.
set success [CkCert_SetPrivateKey $cert $privKey]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    exit
}

set http [new_CkHttp]

set success [CkHttp_SetSslClientCert $http $cert]
if {$success == 0} then {
    puts [CkHttp_lastErrorText $http]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkHttp $http
    exit
}

# Calculate the Digest and add the "Digest" header.  Do the equivalent of this:
# payload="grant_type=client_credentials"
# payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
# digest=SHA-256=$payloadDigest
set crypt [new_CkCrypt2]

CkCrypt2_put_HashAlgorithm $crypt "SHA256"
CkCrypt2_put_EncodingMode $crypt "base64"
set payload "grant_type=client_credentials"
set payloadDigest [CkCrypt2_hashStringENC $crypt $payload]

# Calculate the current date/time and add the Date header.  
# reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")  
set dt [new_CkDateTime]

CkDateTime_SetFromCurrentSystemTime $dt
# The desire date/time format is the "RFC822" format.
CkHttp_SetRequestHeader $http "Date" [CkDateTime_getAsRfc822 $dt 0]

# Calculate signature for signing your request
# Duplicate the following code:

# 	httpMethod="post"
# 	reqPath="/oauth2/token"
# 	signingString="(request-target): $httpMethod $reqPath
# 	date: $reqDate
# 	digest: $digest"
# 	signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`

set httpMethod "POST"
set reqPath "/oauth2/token"

set sbStringToSign [new_CkStringBuilder]

CkStringBuilder_Append $sbStringToSign "(request-target): "
CkStringBuilder_Append $sbStringToSign $httpMethod
CkStringBuilder_ToLowercase $sbStringToSign
CkStringBuilder_Append $sbStringToSign " "
CkStringBuilder_AppendLine $sbStringToSign $reqPath 0

CkStringBuilder_Append $sbStringToSign "date: "
CkStringBuilder_AppendLine $sbStringToSign [CkDateTime_getAsRfc822 $dt 0] 0

CkStringBuilder_Append $sbStringToSign "digest: SHA-256="
CkStringBuilder_Append $sbStringToSign $payloadDigest

set signingPrivKey [new_CkPrivateKey]

set success [CkPrivateKey_LoadPemFile $signingPrivKey "qa_data/certs_and_keys/ING/example_client_signing.key"]
if {$success == 0} then {
    puts [CkPrivateKey_lastErrorText $signingPrivKey]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkHttp $http
    delete_CkCrypt2 $crypt
    delete_CkDateTime $dt
    delete_CkStringBuilder $sbStringToSign
    delete_CkPrivateKey $signingPrivKey
    exit
}

set rsa [new_CkRsa]

set success [CkRsa_ImportPrivateKeyObj $rsa $signingPrivKey]
if {$success == 0} then {
    puts [CkRsa_lastErrorText $rsa]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkHttp $http
    delete_CkCrypt2 $crypt
    delete_CkDateTime $dt
    delete_CkStringBuilder $sbStringToSign
    delete_CkPrivateKey $signingPrivKey
    delete_CkRsa $rsa
    exit
}

CkRsa_put_EncodingMode $rsa "base64"
set b64Signature [CkRsa_signStringENC $rsa [CkStringBuilder_getAsString $sbStringToSign] "SHA256"]

set sbAuthHdrVal [new_CkStringBuilder]

CkStringBuilder_Append $sbAuthHdrVal "Signature keyId=\"e77d776b-90af-4684-bebc-521e5b2614dd\","
CkStringBuilder_Append $sbAuthHdrVal "algorithm=\"rsa-sha256\","
CkStringBuilder_Append $sbAuthHdrVal "headers=\"(request-target) date digest\","
CkStringBuilder_Append $sbAuthHdrVal "signature=\""
CkStringBuilder_Append $sbAuthHdrVal $b64Signature
CkStringBuilder_Append $sbAuthHdrVal "\""

set sbDigestHdrVal [new_CkStringBuilder]

CkStringBuilder_Append $sbDigestHdrVal "SHA-256="
CkStringBuilder_Append $sbDigestHdrVal $payloadDigest

# Do the following CURL statement:

# 	curl -i -X POST "${httpHost}${reqPath}" \
# 	-H 'Accept: application/json' \
# 	-H 'Content-Type: application/x-www-form-urlencoded' \
# 	-H "Digest: ${digest}" \
# 	-H "Date: ${reqDate}" \
# 	-H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
# 	-d "${payload}" \
# 	--cert "${certPath}tlsCert.crt" \
# 	--key "${certPath}tlsCert.key"

set req [new_CkHttpRequest]

CkHttpRequest_AddParam $req "grant_type" "client_credentials"
CkHttpRequest_AddHeader $req "Accept" "application/json"
CkHttpRequest_AddHeader $req "Date" [CkDateTime_getAsRfc822 $dt 0]
CkHttpRequest_AddHeader $req "Digest" [CkStringBuilder_getAsString $sbDigestHdrVal]
CkHttpRequest_AddHeader $req "Authorization" [CkStringBuilder_getAsString $sbAuthHdrVal]
# resp is a CkHttpResponse
set resp [CkHttp_PostUrlEncoded $http "https://api.sandbox.ing.com/oauth2/token" $req]
if {[CkHttp_get_LastMethodSuccess $http] == 0} then {
    puts [CkHttp_lastErrorText $http]
    delete_CkCert $cert
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkHttp $http
    delete_CkCrypt2 $crypt
    delete_CkDateTime $dt
    delete_CkStringBuilder $sbStringToSign
    delete_CkPrivateKey $signingPrivKey
    delete_CkRsa $rsa
    delete_CkStringBuilder $sbAuthHdrVal
    delete_CkStringBuilder $sbDigestHdrVal
    delete_CkHttpRequest $req
    exit
}

# If successful, the status code = 200
puts "Response Status Code: [CkHttpResponse_get_StatusCode $resp]"
puts [CkHttpResponse_bodyStr $resp]

set json [new_CkJsonObject]

CkJsonObject_Load $json [CkHttpResponse_bodyStr $resp]

delete_CkHttpResponse $resp

CkJsonObject_put_EmitCompact $json 0
puts [CkJsonObject_emit $json]

# A successful response contains an access token such as:
# {
#   "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
#   "expires_in": 905,
#   "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
#   "token_type": "Bearer",
#   "keys": [
#     {
#       "kty": "RSA",
#       "n": "3l3rdz4...04VPkdV",
#       "e": "AQAB",
#       "use": "sig",
#       "alg": "RS256",
#       "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
#     }
#   ],
#   "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
# }

# Use this online tool to generate parsing code from sample JSON: 
# Generate Parsing Code from JSON

set access_token [CkJsonObject_stringOf $json "access_token"]
set expires_in [CkJsonObject_IntOf $json "expires_in"]
set scope [CkJsonObject_stringOf $json "scope"]
set token_type [CkJsonObject_stringOf $json "token_type"]
set client_id [CkJsonObject_stringOf $json "client_id"]
set i 0
set count_i [CkJsonObject_SizeOfArray $json "keys"]
while {$i < $count_i} {
    CkJsonObject_put_I $json $i
    set kty [CkJsonObject_stringOf $json "keys[i].kty"]
    set n [CkJsonObject_stringOf $json "keys[i].n"]
    set e [CkJsonObject_stringOf $json "keys[i].e"]
    set use [CkJsonObject_stringOf $json "keys[i].use"]
    set alg [CkJsonObject_stringOf $json "keys[i].alg"]
    set x5t [CkJsonObject_stringOf $json "keys[i].x5t"]
    set i [expr $i + 1]
}

# This example will save the JSON containing the access key to a file so that
# a subsequent example can load it and then use the access key for a request, such as to create a payment request.
CkJsonObject_WriteFile $json "qa_data/tokens/ing_access_token.json"

delete_CkCert $cert
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkHttp $http
delete_CkCrypt2 $crypt
delete_CkDateTime $dt
delete_CkStringBuilder $sbStringToSign
delete_CkPrivateKey $signingPrivKey
delete_CkRsa $rsa
delete_CkStringBuilder $sbAuthHdrVal
delete_CkStringBuilder $sbDigestHdrVal
delete_CkHttpRequest $req
delete_CkJsonObject $json