SSO Authentication with Postman
Overview
Armor uses ADFS and OAUTH workflow for the portal and API authentication. By presenting a retrieved Bearer id_token to the API a user can leverage the API documentation to access all endpoints from both the Legacy and v2 API. Below is documentation to retrieve a token from Armor's SSO platform using your Armor user account that does not have MFA enabled.
Postman Example
(Right click to save as)
Armor Okta API SSO.postman_collection.json
Instructions:
Requesting an ID Token
Authentication and ID token generation is handled by https://auth.armor.com To authenticate and receive an ID token, please follow these steps:
Authenticate
POST : https://auth.armor.com/api/v1/authn
Body: {
"username":"{UserNameWithOutMFA}",
"password":"{Password}"
}
Provide a username (which does not have MFA enabled) and password. This endpoint will return a SessionToken in response.
A subsequent call to GET https://amp.armor.com/oauth2/default/v1/authorize end point with required query string parameters would return the Id_Token
QUERY STRING PARAMETERS
response_type required | string The expected response type. Always id_token |
response_mode required | string The method by which the ID token will be returned. Always form_post |
client_id required | String Use this client_Id "0oab141ypCQYHHQgI696" |
redirect_uri required | string The base URL of the API that will be used in this session. Example: https://api.armor.com/ |
sessionToken required | Value received from the above step |
scope required | string openid email profile |
State required | string "state-296bc9a0-a2a2-4a57-be1a-d0e2fd9bb601" |
Nonce required | string "g5ly497e8ps" |
Prompt required | string none |
The returned body will contain an HTML <form> element containing the ID token. Proceed to the next relevant step based on the client_id you submitted with the request. This endpoint will return a 200 response. If your HTTP client supports following redirects, enable that option. Otherwise, perform a subsequent GET of the returned location header.
Response:
Retrieve Your ID Token
Use Xpath or a similar parser to get the value of the id_token HTML input:
XPath Example
xpath 'html/body/form/input[@name="id_token"]/@value'
The resulting value is your ID token. You can now use it to make requests to any OAuth2 endpoint
Requesting a Scoped Access Token
Scoped access token generation is handled by api.armor.com and requires a valid ID token. To retrieve a scoped access token, make the following API request with your ID token:
POST https://api.armor.com/auth/token
QUERY STRING PARAMETERS
scope required | string A space-delimited list of scopes to assign to the access token. A full list of permission scopes are available by going to the Roles and Permissions Screen in the Armor Management Portal and selecting a role. The scope name will be the "System" name prefixed with *: For example, if the system for a given permission is log-management, the corresponding scope is *:log-management The list of scopes must always include at least openid, email, and profile |
REQUEST HEADERS
authorization required | string The authorization header including the Bearer scheme and the ID token from above. Example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9… |
REQUEST BODY SCHEMA application/json
(None) | null The body of this request must be exactly null. |
RESPONSE BODY SCHEMA application/json
assertion
| null The resulting scoped access token as a JWT. |
scope
| null A space separated list of scopes included on the token. This should be identical to the requested scopes unless the user does not have any permissions applicable to a requested scope, in which case that scope is excluded. |
token_type
| null The type of token returned in the assertion field. Always jwt-bearer. |
You can now use the access token from the assertion property of the response, and the ID token retrieved in the previous step to make API calls to any OAuth2 scoped token endpoint.
Disabling Multi-Factor Authentication (MFA) for Service Accounts
Disabling MFA for service accounts, scripts, and other non-interactive integrations can be done by creating a ticket requesting MFA be disabled for a certain account. Please be sure to provide justification and an administrator's approval in the ticket.