# OAuth2 Basic - Legacy replies
**URL:** https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610
**Category:** SSO
**Tags:** oauth2
**Created:** [September 30, 2015, 9:07pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610 "2015-09-30T21:07:10Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@David\_Detlefsen](https://meta.discourse.org/u/David_Detlefsen)
#### Post date: [September 30, 2015, 9:07pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/1 "2015-09-30T21:07:10Z")
So happy to be integrating our discourse instance with our OAuth server. Thank you.
Part 1: I was able to get our OAuth server popping up and go through the user grant flow.
For part 2, the way we GET user data is at the endpoint https://…/users and our access token in provided in the header as follows:
Authorization: Bearer {ACCESS TOKEN HERE}
Accept: application/json
Content-Type: application/json;charset=utf-8
I don’t think we provide the access token as a URL parameter. What advice can you provide?
Thanks for any help in advance.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [September 30, 2015, 9:26pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/2 "2015-09-30T21:26:59Z")
I think I could add an option to support it as an auth header like this as it seems quite common.
---
### Author:  [@David\_Detlefsen](https://meta.discourse.org/u/David_Detlefsen)
#### Post date: [September 30, 2015, 9:51pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/3 "2015-09-30T21:51:12Z")
Let me confirm one thing… our instance happens to have a DNS entry of [community.zatar.com](http://community.zatar.com). Would that make my DISCOURSE\_HOST be [community.zatar.com](http://community.zatar.com) too?
In other words, when I register with my OAuth provider, should my entry be “[http://community.zatar.com/auth/oauth2\_basic/callback](http://community.zatar.com/auth/oauth2_basic/callback)” or something else?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [September 30, 2015, 11:33pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/4 "2015-09-30T23:33:43Z")
> [@Discourse OAuth2 Basic](https://meta.discourse.org/t/discourse-oauth2-basic/33879/4):
>
> In other words, when I register with my OAuth provider, should my entry be “[http://community.zatar.com/auth/oauth2\_basic/callback](http://community.zatar.com/auth/oauth2_basic/callback)” or something else?
Yup, that’s correct.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 1, 2015, 7:36pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/5 "2015-10-01T19:36:02Z")
> [@Discourse OAuth2 Basic](https://meta.discourse.org/t/discourse-oauth2-basic/33879/2):
>
> Authorization: Bearer {ACCESS TOKEN HERE}
Thanks for the suggestion. I’ve added this HTTP header to the JSON request. I tested it with Dropbox as an OAuth2 provider and it worked great. Just get the latest version and you should be good to go!
---
### Author:  [@David\_Detlefsen](https://meta.discourse.org/u/David_Detlefsen)
#### Post date: [October 2, 2015, 8:14pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/6 "2015-10-02T20:14:05Z")
We are using a hosted instance. Will this latest update need to be pushed to our hosted solution or is there a way for me to go get it?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 2, 2015, 8:33pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/7 "2015-10-02T20:33:43Z")
If you are hosted by us, the oAuth2 plugin should be available on all Business class hosting plans, I believe @eviltrout already enabled that for the Business container.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 10, 2015, 2:18pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/8 "2015-10-10T14:18:28Z")
I can confirm OAuth2 is deployed to all Business customers.
---
### Author:  [@Mark\_Zegarelli](https://meta.discourse.org/u/Mark_Zegarelli)
#### Post date: [October 26, 2015, 5:15pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/9 "2015-10-26T17:15:07Z")
Hey Guys. Posted this question [elsewhere](https://meta.discourse.org/t/adjusting-the-size-of-the-login-popup/34770), but wanted to get it in this thread as well.
Is there a way to adjust the size of the login window when using a custom OAuth2 provider? Default seems to be making an 800x400 window.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 27, 2015, 5:39am UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/10 "2015-10-27T05:39:12Z")
Don’t think so but it should be trivial to add some site settings for that.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [October 30, 2015, 2:45pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/11 "2015-10-30T14:45:33Z")
Would this solve [our earlier query](https://meta.discourse.org/t/add-a-new-oauth2-0-provider/28726) about implementing support for [battlenet oauth](https://dev.battle.net/docs/read/oauth)?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 30, 2015, 5:13pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/12 "2015-10-30T17:13:24Z")
I haven’t looked at their implementation, but there is a good chance it could work if you set it up!
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [October 30, 2015, 5:17pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/13 "2015-10-30T17:17:25Z")
Some of the fields the plugin requires are obvious enough, but their docs don’t give any hints as to the following:
- oauth2 user json url
- oauth2 json user id path
- oauth2 json username path
- oauth2 json name path
- oauth2 json email path
Are all of the above mandatory, or just convenient?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 30, 2015, 5:22pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/14 "2015-10-30T17:22:54Z")
They are required. We need a JSON endpoint to retrieve information about the user with the token. (See Part 2 in the original post for more details).
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [October 30, 2015, 5:27pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/15 "2015-10-30T17:27:59Z")
Ok, makes sense, in which case it might not be viable, I don’t think Blizzard will return the email for starters.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 30, 2015, 5:35pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/16 "2015-10-30T17:35:34Z")
Oops sorry I should have been more clear – the only mandatory field is the json\_user\_id\_path. The others are optional but you need at least one from the JSON endpoint.
---
### Author:  [@mazine](https://meta.discourse.org/u/mazine)
#### Post date: [November 10, 2015, 2:53pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/17 "2015-11-10T14:53:52Z")
Hi,
I found that [there is a piece of code](https://github.com/discourse/discourse-oauth2-basic/blob/7bc71b537867ef44c295041500e102739514cb38/plugin.rb) that builds correct basic authorization header for token request:
```plaintext
def basic_auth_header
"Basic " + Base64.strict_encode64("#{SiteSetting.oauth2_client_id}:#{SiteSetting.oauth2_client_secret}")
end
```
But it looks like this code isn’t called. At least we see that our OAuth 2.0 server doesn’t receive any authorization header with the `/token` request. Could you please check that authorization header is actually passed to OAuth 2.0 server?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [November 10, 2015, 5:35pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/18 "2015-11-10T17:35:47Z")
It is called just [a few lines before](https://github.com/discourse/discourse-oauth2-basic/blob/master/plugin.rb#L27) in the function that creates the token’s headers.
---
### Author:  [@mazine](https://meta.discourse.org/u/mazine)
#### Post date: [November 11, 2015, 12:58pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/19 "2015-11-11T12:58:34Z")
Yes, that’s correct. The problem is that the method `build_access_token` ain’t called. And as a result the method `basic_auth_header` is never called either ☹
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [November 11, 2015, 6:01pm UTC](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610/20 "2015-11-11T18:01:44Z")
Okay I think I’ve fixed it here, can you try the latest version of the plugin?
[https://github.com/discourse/discourse-oauth2-basic/commit/27ff369904f1389216e485b4da64b59b45fef671](https://github.com/discourse/discourse-oauth2-basic/commit/27ff369904f1389216e485b4da64b59b45fef671)
(It’s hard for me to test as I don’t have a provider which needs that header)
[Next page](https://meta.discourse.org/t/oauth2-basic-legacy-replies/90610.md?page=2)