Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save javafun/edd7c9feb5c4c723f4eca26a29b99c9b to your computer and use it in GitHub Desktop.
Save javafun/edd7c9feb5c4c723f4eca26a29b99c9b to your computer and use it in GitHub Desktop.
Postman collection to get userinfo via ADFS 4.0 and OpenID Connect / OAuth 2.0
{
"variables": [],
"info": {
"name": "ADFS Public",
"_postman_id": "3d8a90ce-eb38-fedf-8bfe-b75578dd0810",
"description": "Auth code flow.",
"schema": "https://schema.getpostman.com/json/collection/v2.0.0/collection.json"
},
"item": [
{
"name": "Authorize Request",
"request": {
"url": "https://[adfs fqn]/adfs/oauth2/authorize?client_id=[client_id]&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%3A1234&response_mode=query&scope=openid",
"method": "GET",
"header": [],
"body": {},
"description": "A sign in request to begin the OAuth 2.0 code flow. Be sure to copy & paste into a browser! Running this request in Postman will just return you the HTML of our login pages. You need to fill in your own tenant ID and clientID. You can get the tenant ID from the ADFS endpoints in the wizard. Running this will ask you for your AD credentials. Note that this will return a 'HTTP Error 404.0 - Not Found' because there is no 'localhost/myapp'. Just ignore and copy the code - the section after '?code=' "
},
"response": []
},
{
"name": "Token Request - Auth Code",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": "tests['Status Code is 200'] = (responseCode.code === 200);\n\nif (responseCode.code === 200) {\n \n try {\n var tokens = JSON.parse(responseBody),\n access_token = tokens.access_token;\n }\n\n catch(e) {\n console.log(e);\n }\n \n postman.setGlobalVariable(\"access_token\", access_token);\n}"
}
}
],
"request": {
"url": "https://[adfs fqn]/adfs/oauth2/token",
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/x-www-url-form-urlencoded",
"description": ""
}
],
"body": {
"mode": "urlencoded",
"urlencoded": [
{
"key": "client_id",
"value": "[client_id]",
"type": "text",
"enabled": true
},
{
"key": "scope",
"value": "openid",
"type": "text",
"enabled": true
},
{
"key": "redirect_uri",
"value": "https://localhost:1234",
"type": "text",
"enabled": true
},
{
"key": "grant_type",
"value": "authorization_code",
"type": "text",
"enabled": true
},
{
"key": "client_secret",
"value": "[client_secret]",
"type": "text",
"enabled": true
},
{
"key": "code",
"value": "[code]",
"type": "text",
"enabled": true
}
]
},
"description": "The POST request to exchange an auth code for an access token. Be sure to replace the code with your own, that you received after signing in! Again you need to fill in your own client_id and client_secret. Then click 'Send'. This will return an access token, an ID token and a refresh token. You can see what's in the access / ID token by copy / paste into 'jwt.io' in a browser. "
},
"response": []
},
{
"name": "Userinfo Request",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": "tests['Status Code is 200'] = (responseCode.code === 200);\n"
}
}
],
"request": {
"url": "https://[adfs fqn]/adfs/userinfo",
"method": "GET",
"header": [
{
"key": "Authorization",
"value": "Bearer {{access_token}}",
"description": ""
}
],
"body": {
"mode": "formdata",
"formdata": []
},
"description": "An example use of the access_token. Normally you would replace the access token with the one you got from the token request! This is done autimatically. Just click 'Send'. You should get attributes like 'sub' back."
},
"response": []
}
]
}
@catclaw63
Copy link

can you show me how to get access code? I dont see code from Postman GET

Thanks

@bv
Copy link

bv commented Sep 1, 2021

@catclaw63,
I am also searching the way to get requests completely automatic. For now the description for the request in the collection says that you need to use browser to send the query and not the Postman, then get the code from the value of the "Location" response header.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment