Scope groups in API - use name or group id?

[Ullsokk]

I am trying to register an application using the following python code: 

headers = {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + IDtoken ,
}

data = { "client_id": "myclientid",
        "client_secret": "myclientsecret",
        "scope": ["openid", "group1"],
        "authorized_grant_types": ["authorization_code","refresh_token"],
        "redirect_uri": "urn:ietf:wg:oauth:2.0:oob" }

I have one custom group in Viya that I want to include in scope, in addition to "openid". Am I supposed to use the group name or the group ID in the request? The group name is something like MF_modelfactory_RW, and group id is, by happenstance, "group1" (just as the example code).   

[joeFurbee · Accepted solution]

Hi @Ullsokk,

The value for 'scope' in your code should be the group ID. This would be as it appears in SAS Environment Manager.

I took a look in my EM instance and see Name: Esri Users and ID: EsriUsers. In this instance I'd use EsriUsers in the scope.

Here's a link to a SASGF paper on OAuth and Viya. I consider it my go to for questions. Perhaps you will find it of use, if you'd not already discovered it.

Thanks,

Joe

[Ullsokk]

Thank you!

Is this (the fact that group ID as opposed to name is expected) explicitly stated somewhere official? Just wondering I am missing some major part of the documentation, as I can't find this in writing anywhere

[alancox]

Hi @Ullsokk 

there's some good examples (& similar questions) in this SAS blog post by @joeFurbee  :

https://blogs.sas.com/content/sgf/2019/01/25/authentication-to-sas-viya/

Alan

[joeFurbee]

Hi @Ullsokk,

In addition to the post @alancox mentions, you can refer to @MikeRoda 's SASGF paper: OpenID Connect Opens the Door to SAS Viya APIs. I checked with Mike before I originally answered your question. He's the true SME on OAuth.

Thanks,

Joe