Using OAuth 2.0 for Authentication

For secure access to the APIs Application Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software., the Aruba Central API Framework plug-in supports OAuth Open Standard for Authorization. OAuth is a token-based authorization standard that allows websites or third-party applications to access user information, without exposing the user credentials. protocol for authentication and authorization. OAuth 2.0 is a simple and secure authorization framework. It allows applications to acquire an access token for Aruba Central through a variety of work flows supported within the OAuth 2.0 specification.

All OAuth 2.0 requests must use the SSL Secure Sockets Layer. SSL is a computer networking protocol for securing connections between network application clients and servers over the Internet. endpoint available at the Domain URL Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. (for example, https://app1-apigw.central.arubanetworks.com).

Access and Refresh Tokens

The access token is a string that identifies a user, app, or web page and is used by the app to access an API. The access tokens provide a temporary and secure access to the APIs.

The access tokens have a limited lifetime. If the application uses web server or user-agent OAuth authentication flows, a refresh token is provided during authorization that can be used to get a new access token.

If you are writing a long running applications (web app) or native mobile application you should refresh the token periodically. For more information, see Refreshing a token.

This section includes the following topics:

• Obtaining Access Token
• Accessing APIs
• Accessing Tenant APIs using MSP Access Token
• Viewing and Revoking Tokens
• Adding a New Token

Obtaining Access Token

Users can generate the OAuth token using one of the following methods:

• Obtaining Token Using Offline Token Mechanism
• Obtaining Token Using OAuth Grant Mechanism

Accessing APIs

To access the API, use the Domain URL (for example, https://app1-apigw.central.arubanetworks.com/).

This endpoint is accessible over SSL and the HTTP Hypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. (non-SSL) connections are redirected to the SSL port.

Table 1: Accessing the API

URL	Description
Domain URL For example, https://app1-apigw.central.arubanetworks.com/	The API gateway URL. All APIs can be accessed from this URL by providing a correct access token.

The parameters for the API are as follows:

Table 2: Parameters for the API

Parameter	Value	Description
request_path	URL Path	URL path of an API, for example, to access monitoring APIs, use the path /monitoring/v1/aps.

Table 3: Header for the API

Header	Value	Description
Authorization	Bearer <access token>	Pass the access token in the header.

Example

Request Method: GET GET refers HTTP request method or an SNMP operation method. The GET HTTP request method submits data to be processed to a specified resource. The GET SNMP operation method obtains information from the Management Information Base (MIB).

request_path: https://app1-apigw.central.arubanetworks.com/monitoring/v1/aps

Request Header:

Authorization: Bearer ouzMaXEBbB6XqGtsWomK7MvaTuhrqDQ1

Response:

Accessing Tenant APIs using MSP Access Token

MSP Managed Service Provider. The Managed Service Provider (MSP) mode is a multi-tenant operational mode that Aruba Central accounts can be converted into, provided these accounts have subscribed to the Aruba Central app. users can use their access token to perform the operation on their tenant accounts using NBAPI. User privileges as per the tenant role are applied for these operations. An MSP user must provide the tenant info (CID Customer ID is an authentication mechanism used within computing systems, networks, and applications.) as part of the request header.

Table 4: Header for the API

Header	Value	Description
TenantID	267958b55d5a463e94a302c20f4a6b68	Pass the tenant CID.

Example

Request Method: GET

https://app1-apigw.central.arubanetworks.com/central/v2/sites

Request Header:

TenantID: 267958b55d5a463e94a302c20f4a6b68

Response Code: 200

Response:

Viewing and Revoking Tokens

To view or revoke tokens, complete the following steps:

1. In the Aruba Central app, set the filter to Global.
2. Under Maintain, click Organization > Platform Integration > Rest API.
   The API Gateway page is displayed.
3. Click My Apps & Tokens. The Token List table displays the following:
   • Token ID—Token ID of the application.
   • User Name—Name of the user to whom this token is associated to. An application can be associated to multiple users.
   • Application—Name of the application to which this token is associated to. For example, Aruba Central.
   • Generated At—Date on which the token was generated.
   • Revoke Token—Click Revoke Token and click Yes to revoke the token associated to a particular user. For example, if two users are associated to an application and if you want to remove access to a particular user, revoke the token associated to that user.
   • Download Token—Click Download Token to download the token.

Adding a New Token

To add a new token, complete the following steps:

1. In the Aruba Central app, set the filter to Global.
2. Under Maintain, click Organization > Platform Integration > Rest API.
   The API Gateway page is displayed.
3. Click My Apps & Tokens. The Token List table displays the following:
   • Token ID—Token ID of the application.
   • User Name—Name of the user to whom this token is associated to. An application can be associated to multiple users.
   • Application—Name of the application to which this token is associated to. For example, Aruba Central.
   • Generated At—Date on which the token was generated.
   • Revoke Token—Click Revoke Token and click Yes to revoke the token associated to a particular user. For example, if two users are associated to an application and if you want to remove access to a particular user, revoke the token associated to that user.
   • Download Token—Click Download Token to download the token.

4. Click + Add Apps & Tokens to add a new token.
5. Enter the application name in the Application Name box and click Generate.