Inthe portal, go to the Data Lake Analytics account and look for the job by using the Data Factory activity run ID (don't use the pipeline run ID). The job there provides more information about the error, and will help you troubleshoot. If the resolution isn't clear, contact the Data Lake Analytics support team and provide the job Universal Resource Locator (URL), which includes In Authorization code grant type, User is challenged to prove their identity providing user credentials. Upon successful authorization, the token end point is used to obtain an access token. The obtained token is sent to the resource server and gets validated before sending the secured data to the client application. To protect an API with Azure AD, first register an application in Azure AD that represents the API. The following steps use the Azure portal to register the application. First we need to access our the AAD tenant we created in the excercise before, be sure you are in the right tenant. Then select App registrations under Azure Portal to register an application Select New registration. In the Name section, enter a meaningful application name that will be displayed to users of the app. For example oauth-backend-app In the Supported account types section, select an option that suits your scenario. Leave the Redirect URI section empty. Select Register to create the application. On the app Overview page, find the Application client ID value and record it for later. Select Expose an API and set the Application ID URI with the default value. Record this value for later. Select the Add a scope button to display the Add a scope page. Then create a new scope that’s supported by the API for example, Select the Add scope button to create the scope. Repeat this step to add all scopes supported by your API. When the scopes are created, make a note of them for use in a subsequent step. Every client application that calls the API needs to be registered as an application in Azure AD. In this example, the client application is the Developer Console in the API Management developer portal. In this case we will register another application in Azure AD to represent the Developer Console Select New registration. In the Name section, enter a meaningful application name that will be displayed to users of the app. For example oauth-client-app In the Supported account types section, select an option that suits your scenario. Leave the Redirect URI section empty. Select Register to create the application. On the app Overview page, find the Application client ID value and record it for later. Create a client secret for this application to use in a subsequent step. From the left menu options for your client app, select Certificates & secrets, and select New client secret. Under Add a client secret, provide a Description. Choose when the key should expire and select Add. When the secret is created, note the key value for use in a subsequent step. Grant permissions for client-app to call backend-app Now we have to open our client app and choose the option API permissions In here we need to click on Add a permission Then choose My APIs Select the record for backend-app-oauth Then select the Delegated Permissions option Then mark the checkbox Then click the Add Permissions button Finally click the Grant admin consent for ... Enable OAuth in the Developer Console for Authorization Code Grant type At this point, we have created the applications in Azure AD, and granted proper permissions to allow the client-app to call the backend-app. In this demo, the Developer Console is the client-app and has a walk through on how to enable OAuth user authorization in the Developer Console. Steps mentioned below In Azure portal, browse to your API Management instance and Select OAuth > Add. Provide a Display name and Description. For the Client registration page URL, enter a placeholder value, such as http//localhost. For Authorization grant types, select Authorization code. Specify the Authorization endpoint URL and Token endpoint URL. These values can be retrieved from the Endpoints page in your Azure AD tenant. Browse to the client App registrations page again and select Endpoints. Endpoints versions We recommend using v2 endpoints. When using v2 endpoints, use the scope you created for the backend-app in the Default scope field. Also, make sure to set the value for the accessTokenAcceptedVersion property to 2 in your application manifest in Azure AD Client APP and Backend app. Next, specify the client credentials. These are the credentials for the client-app. For Client ID, use the Application ID of the client-app. For Client secret, use the key you created for the client-app earlier. Immediately following the client secret is the redirect_urls Go back to your client-app registration in Azure Active Directory under Authentication. Paste the redirect_url under Redirect URI, and check the issuer tokens then click on Configure button to save. Now that you have configured an OAuth authorization server, the Developer Console can obtain access tokens from Azure AD. The next step is to enable OAuth user authorization for your API. This enables the Developer Console to know that it needs to obtain an access token on behalf of the user, before making calls to your API. Go to APIs menu under the APIM Select the Basic Calculator API and Go to Settings. Under Security, choose OAuth select the OAuth server you configured earlier and select save. Publish the developer portal again to refresh this changes Calling the API from the Developer Portal Now that the OAuth user authorization is enabled on your API, the Developer Console will obtain an access token on behalf of the user, before calling the API. Copy the developer portal url from the overview blade of apim Browse to any operation under the Basic Calculator API in the developer portal and select Try it. This brings you to the Developer Console. Note a new item in the Authorization section, corresponding to the authorization server you just added. Select Authorization code from the authorization drop-down list, and you are prompted to sign in to the Azure AD tenant. If you are already signed in with the account, you might not be prompted. After successful sign-in, an Authorization header is added to the request, with an access token from Azure AD. The following is a sample token Base64 encoded Select Send to call the API successfully with 200 ok response. At this point we can call the APIs with the obtained bearer token. However, what if someone calls your API without a token or with an invalid token? For example, try to call the API without the Authorization header, the call will still go through. This is because the API Management does not validate the access token, It simply passes the Authorization header to the back-end API. To pre-Authorize requests, we can use validate-jwt Policy by validating the access tokens of each incoming request. If a request does not have a valid token, API Management blocks it. We will now configure the Validate JWT policy to pre-authorize requests in API Management, by validating the access tokens of each incoming request. If a request does not have a valid token, API Management blocks it. Browses to the APIs from the left menu of APIM Click on Basic Calculator Api and open the inbound policy to add the validate-jwt policyIt checks the audience claim in an access token and returns an error message if the token is not valid. and save it. You will need to get the id of your scope, you set from you backend-app registration. Normally this comes in the form api//d183fdbe-fc28-4ef7-9ca1-e7b4a4cd1ff8/ , we need to use the id d183fdbe-fc28-4ef7-9ca1-e7b4a4cd1ff8 as audience YOUR-BACKENDAPP-SCOPE-ID Go back to the developer portal and send the api with invalid token. You would observe the 401 unauthorized. Modify the token from authorization header to the valid token and send the api again to observe the 200-ok response. Understanding validate-jwt Policy In this section, we will be focusing on understanding how validate-jwt policy works the image in the right side is the decoded JWT Token The validate-jwt policy supports the validation of JWT tokens from the security viewpoint, It validates a JWT JSON Web Token passed via the HTTP Authorization header If the validation fails, a 401 code is returned. The policy requires an openid-config endpoint to be specified via an openid-config element. API Management expects to browse this endpoint when evaluating the policy as it has information which is used internally to validate the token. Please Note OpenID config URL differs for the v1 and v2 endpoints. The required-claims section contains a list of claims expected to be present on the token for it to be considered valid. The specified claim value in the policy must be present in the token for validation to succeed. The claim value should be the Application ID of the Registered Azure AD Backend-APP. Newphishing technique: device code authentication. What is device code authentication. Phishing with device code authentication. 1. Connecting to /devicecode endpoint. 2. Creating a phishing email. 3. “Catching the fish” - victim performs the authentication. I was trying to build an Azure Function with the ability of accessing Microsoft Graph API. Imagine, this function must trigger every night and pickup some emails and organize them in to a folder. So there shouldn’t be any user interactions right. You just can’t got every night and login using your credentials and then let the function you know, Microsoft Graph API require a “Bearer” access token to make a successful call to the API, else and Access Denied 401 Unauthorized is thrown. The request header must have a “Bearer” authorization token to make a successful call. And this token must be valid way of doing this isCreate a login using your Work, Office or Personal Microsoft the Access the token and call Microsoft you look at the above scenario we can’t login to the system and it should be a silent login. And there shouldn’t be any user interaction to do this. But if you could skip step 1 and 2 and straight away get the token? Yes you can and let’s find out how to do will be looking at completing these stepsCreate an Azure AD Application in your some permissions to the application for accessing Microsoft an admin account consent on behalf of their a password a key for the code using these information to get an access Azure AD ApplicationLets goto your organizations active directory, by following this URL successful login will bring you up the AAD admin Admin PanelNow in the left side pane click the label “Azure Active Directory”Azure Active DirectoryThis will open up the blade for Azure Active Directory. In that screen should see a label “App registrations”. This is the starting point of a registering an Azure AD registrationsThis blade will allow you to create a new application for Azure AD. Lets have a look on the AD Application RegistrationAs you see, might get a bunch of apps already have, and a button on the top “New registration”. Let’s click on that button to create a new application registrationNow you will see the new application registration application registrationName → This will be the name of your application. In this case, I have given “NodeJS-Tutorial-App”. Of course it’s up to you to choose name for your app. If it’s already there, don’t worry Azure is smart enough to let you account types → This section will restrict the access. The options are in this organizational directory only — Only users of your organization can access the resources using this in any organizational directory — Anybody who has a Microsoft work or school account can access APIs that allowed to your in any organizational directory and personal Microsoft accounts — This will allow anybody who has a Microsoft live account, work or school account can use your application to access allowed APIs to that have chosen the third option. And again it is all up to URI → We don’t really worry about this part, cause we don’t accept any redirection to our app after login. But I have given a value as localhost3000Now let’s hit the “Register” button. And you should see the newly registered applications is createdNow you have to note down few things here. We will be using these to build our client ID → The id of your application Directory tenant ID → The Azure AD tenant idNext step is to get the token endpoint. This end point will generate the token for you. Generated token from this endpoint will be used to access Microsoft Graph API on the “Endpoints” button on the top of the buttonThis will get all the endpoints for your application. Make sure you copy down the endpoint for OAuth token endpoint v2OK, lets have a look on the next stepAllowing permissions for Microsoft Graph APIIn the “NodeJs-Tutorial-App” application blade, click on the “API permissions” permissions for Azure AD ApplicationAs you see, Azure has already given you “ delegated permissions for your application. This permission will allow us to read user information for a logged in user. These are Microsoft Graph API permissions, in other hand we can call them as “Scopes”.Have a read here for the full list of scopes for Microsoft Graph I mentioned before there are two methods of permission types can be used with an Azure AD You will use this application on behalf of a user. For an example, if I logged in using my Work or School account, I am allowing this application to use my credentials on behalf of give the permission to this specific app. No user is now, you must have realize what type of permissions we need use to get a token for Microsoft Graph API. Yes, you are correct we need “Application” on the available “ permission and delete permissionNow, click on “+ Add a permission” button and select “Microsoft Graph”Select Microsoft Graph permissionClick on “Application permissions”. Now you see a list of permissions available for Microsoft Graph permissions for Microsoft one or more depending on your need, click “Add permissions” admin consentWarning of admin has to consentDid you see the WARNING!!!?. Don’t worry and means an admin of your organization must allow this application to access the selected permission on behalf of the click “Grant admin consent for ” has granted consentExcellent, you are almost a key password for the applicationLet’s create a key for the application. Since we are not going to interact with any of the users. We need this key. Let’s create one. Click on the “Certificates & secrets”Certificates & secretsNow click on the “+ New client secret” and give a name and select an expiration a keyAnd click “Add”, and make sure you have copied the key down. When you go away from this screen. Azure doesn’t allow you to see this key generated keyExcellent, now you have everything to get the token using a do a checklistApplication ID → ✔️Tenant ID → ✔️Application permissions → ✔️Token Endpoint → ✔️Admin grant consents → ✔️Generate a client key and copy it down → ✔️Now you can use favorite language to generate this simple app to get the tokenFire up your favorite shell and create a directory and go inside it. Execute the following command.$ npm init -yNow you should have a simple node application. Again type the following command to create the “ touch open up your favorite editor or just type the following command. I am using Visual Studio Code. Grab it from here $ code .Now select the “ and create these constants at the top of the APP_ID = '[COPIED_APP_ID]’;const APP_SECERET = '[COPIED_APP_SECRET]’;const TOKEN_ENDPOINT =' MS_GRAPH_SCOPE = ' you see MS_GRAPH_SCOPE will hold the scope given to your application. These scopes were given at the time we created the Azure AD application we need to access the token endpoint and create the token. For that we can use the built-in http module in node or we can use a third party npm package. I have used axios here. You can read the full documentation about axios visiting this install the axios i axiosAnd again we need another npm package that will stringyfy the post data. This library will create a proper JSON string from the object you pass. Let’s install that i qsLet’s go back to our editor and add the following code below the constants the we have axios = require'axios';const qs = require'qs';Finally add this codeAs you see in the line 1 to 6 we have created the body for the POST request sent on line 11. The information and the “key” names must look like in the code. And the post content type must be application/x-www-form-urlencoded’.Rest of the code is full code should look like lets do a test$ node You should see an output like thisGenerated access tokenThats it folks. Enjoy. 520(520) Token Tracker on HecoInfo shows the price of the Token $0.00, total supply 520, number of holders 3 and updated information of the token. The token tracker page also shows the analytics and historical data. HT: $9.11 (-6.33%) Home; Blockchain. Top Accounts; View Txns; View Pending Txns; View Contract Internal Txns; View Blocks; Forked Blocks (Reorgs) View Created March 13, 2017 Category Troubleshooting Comments 31 When you schedule a posts on Pilot Poster, in some rare cases, the scheduled posts might hit a hard rock on the way due to some reasons, and among the common reasons for a scheduled post to stop running is the Invalid Access Token error. How to Detect this Error Pilot Poster comes with a Logging feature that stores all of the errors encountered during a scheduled post. And to locate the error log, you need to Navigate to Posts > Scheduled Posts > And Click the Folder Icon at the right-hand side of the displayed table. Fix Invalid Access Token Error In the Log page, you will see the reason why your scheduled posts stopped running and if the error message seen is Invalid Access Token as shown in the image above, then read below to see how to fix; How to Fix Invalid Access Token Error The invalid access token error simply means the token for the selected app used for posting is expired and needs to be re-authenticated. And to fix, all you need to do is Re-authenticate the current app used for posting. To Re-authenticate, Goto Settings > Facebook Apps > Deauthenticate the App. And then click the Authenticate button again. When you click the Authenticate button again, you do NOT need to go through all of the procedures as you would when Authenticating for the first time. Rather, all you need to click is the Get App Authenticate Link As shown in the image below. re-authenticate-app Copy the displayed access token from the next window that displays and then paste in the Access Token Box. Click the Test Access Token to ensure the copied token is valid, then click the Set Access Token Button. You have successfully re-authenticate your app. Now is time for you to resume the paused schedule or schedule a new post using your authenticated app. Was this article helpful? 520Token (520) Token Tracker on BscScan shows the price of the Token $0.00, total supply 1,000,000,000,000,000, number of holders 15 and updated information of the token. The token tracker page also shows the analytics and historical data.
What is UA's NetID+? NetID+ enhances the security of your UA NetID by using technology from Duo Security which leverages your device smartphone or tablet to verify your identity. This prevents anyone but you from accessing applications and services secured with NetID+, even if they know your password. You can complete the second step in the login process in many ways, including approving an alert sent to your smartphone or tablet entering a passcode you received in a text message entering a passcode you received through a phone call pressing the button on a Yubikey hardware token entering a bypass code that you printed out previously Why do I need this? Passwords are becoming increasingly easy to compromise. They can often be stolen, guessed, and hacked — you might not even know who else has your password and is accessing your account. NetID+ adds a second layer of security to your account to make sure that your account stays safe, even if someone else knows your password — and you'll be alerted right away on your phone if someone does know your password and tries to log in with it. This second factor of authentication is separate and independent from your UA NetID username and password step — Duo Security never sees your password. What devices are supported? Apple iOS and Android devices are supported. See Supported Devices for information on installing and using the Duo Security app on various platforms. What if I don't have a smartphone or tablet? There are many other methods available if you don't use a smart device phone/tablet. One-time passcodes OTP can be sent to any phone capable of receiving SMS text messages. Additionally, Yubikey or Feitian OTP hardware tokens can be enrolled and used with NetID+. How do I download the Duo Mobile app? Search your device’s app store for "Duo Mobile". It is available on Android and Apple iOS platforms. What are Duo Mobile and Duo Push? Duo Mobile is an app that allows you to generate passcodes that you can use for NetID+. It is available on Android and Apple iOS platforms. The Duo Mobile app can use Duo Push functionality. When you get to the second step in the NetID+ process, your Duo Mobile app will alert you that somebody is trying to log in with your UA NetID. You can approve or reject the login on your device. What is a "Lifeline" and how is it used? You can configure phones that can be used as Lifeline devices when your regular devices are unavailable. A Lifeline phone usually belongs to somebody you trust and with whom you can easily communicate. For example, if you lose your phone and need to use NetID+, you can log in to the NetID+ management site using just your NetID and password. After you log in, you will see an option to “Use a Lifeline”. When you choose the lifeline you would like to use you may have more than one configured , a verification code will be sent by text message or a phone call to that phone. The owner of that phone can communicate the code to you, and you can enter the code into this application to produce a list of ten bypass codes. Those bypass codes will allow you to complete NetID+. After completing NetID+ login, you can go to the “Manage your Account” page to manage your NetID+ devices. You can remove your lost phone and configure a new device for future logins. You can also print out more bypass codes. What if I don't have access to any of my enrolled devices? If your phone battery dies, you change your phone number, or you otherwise do not have access to any way to authenticate, call the 24/7 IT Support Center at 520 626-8324 TECH. The 24/7 tech will verify your identity and provide you with some NetID+ bypass codes. Add as many devices as you can to give yourself more options. Create a Lifeline, as well, as another backup. I have more than one phone or other device. Can I use both? Yes. You can register any number of devices via the NetID+ “Manage your Account” page under “Add a Device”. I’m confused...what is the difference between the different types of “passcodes” “SMS passcodes” and “Bypass codes”? Any type of passcode can be used anytime you see a “Passcode” field on the NetID+ login page. Here are the type of passcodes available to you, and how they can be generated Duo Mobile passcodes – these are one-time-use passcodes generated within the Duo Mobile app; they can be generated by tapping the “key” button within the app. SMS passcodes – these are sent to your registered device via SMS text message, and are always sent in a batch of 10. You can send a new batch anytime, via the “send more” link on the NetID+ login page, or via the NetID+ self-service site each SMS-capable device will have a “send passcodes” button. SMS passcodes are single-use, and must be used in the order they are listed in the message you receive; the NetID+ site will prompt you to use the next code in the batch by providing the starting digit “Next SMS passcode starts with 4”. Generating a new batch of SMS passcodes invalidates the previous batch. Bypass codes – these are generated from the NetID+ self-service site and are intended to be used as a “rescue” mechanism, when you don’t have access to any of your registered devices. Bypass codes may be printed out and carried with you in your wallet or purse or stored in a secure location. Bypass codes are generated in batches of 10 and can be used in any order unlike SMS passcodes, which must be used sequentially. Each bypass code is good for a single use and generating a new list of bypass codes will invalidate the previous list. Bypass codes are distinct and separate from SMS passcodes – generating a new batch of SMS passcodes will not affect your current list of bypass codes and vice-versa. What hardware tokens does UA NetID+ support? NetID+ supports 2 types of hardware tokens Yubikey Series 5 Feitian OTP c100 Yubikey You can use any of the Yubikey 5 Series devices with NetID+. You can purchase Yubikey Series 5 devices from UA Bookstores or directly from Yubico. Please follow instructions on the Yubico website for downloading configuration software and configuring your Yubikey. Downloading the Yubikey Personalization Tool You can retrieve the Yubikey Manager installer for Mac OS X, Windows and Linux from under “Cross-Platform Tool”. If you are already using this YubiKey with an existing service, the following steps will overwrite the stored secret for that service. You should also realize that every time you open the Yubico OTP tab, it generates a new Public Identity, Private Identity, and Secret Key, but that these are not written to the token unless you actually click Write Configuration. There is no way to read your existing Public Identity, Private Identity, and Secret Key off the token once it has been written. Each YubiKey has two slots. The first slot is used to generate the passcode when the YubiKey button is touched for between and seconds and released. The second slot is used if the button is touched between 2 and 5 seconds. When the YubiKey is shipped its first configuration slot is factory programmed for the YubiCloud OTP service and the second configuration slot is blank. To create or overwrite a slot’s configuration Start the YubiKey Personalization Tool. Insert the YubiKey into a USB port. Wait for the Personalization Tool to recognize the YubiKey. Click “Yubico OTP” Mode. Click “Quick”. Select “Configuration Slot 1” or “Configuration Slot 2” if Slot 1 is already being used by another service. Click “Regenerate”. Uncheck “Hide Values”. You will need the Serial Number in decimal format, Private Identity, and Secret Key to configure the YubiKey with NetID+. You may also want to save this information, along with the Public Identity, somewhere safe since you will need them if you use this YubiKey with other services in the future. Click Write Configuration make sure to do this or your Yubikey won’t work with NetID+ There is no need to click Upload to Yubico. We are able to confirm the passcodes generated independently of their service. However you may do this if you wish to also use the YubiCloud OTP service. Feitian OTP c100 The OTP c100 is a low-cost, small key-chain authentication token. It provides a one-time password OTP by clicking a button on the device. Each OTP is only valid until the next button click. Battery life on the OTP c100 is between 3-5 years depending on use; once the battery dies, the token must be replaced. Feitian OTP tokens may be purchased at UA Bookstores or directly from Feitian. If you purchased your OTP c100 token from UA Bookstores You will only need the serial number printed on the back of the device in order to enroll it. Enter the value in the "Serial Number" field on the OTP c100 enrollment form, and leave the "Seed Value" field blank. If you purchased your OTP c100 token from Feitian You will be asked to select "seed format" and "seed encryption" values, and provide a "seed delivery email" see illustration below. Use the default values on the form for "seed format" and "seed encryption", and use your email address for the "seed delivery email". Feitian will send you 2 emails, one subject "otp info" containing a zip file, and another subject "unzip info" with a password that will be needed to decrypt the zip file when you attempt to open it. DO NOT DELETE OR LOSE THESE EMAILS! Your OTP c100 token will be unusable without the data contained in the zip file. Before enrolling your token, use the password contained in the "unzip info" email to unzip the attachment contained in the "otp info" email, then open the resulting text file in an editor. The file will contain two values, separated by a space. The first value is the serial number of your token also printed on the back of the token — enter this in the "Serial Number" field on the OTP c100 enrollment form. The second value is the token's "seed" — enter this in the "Seed Value" field on the OTP c100 enrollment form. Help! My OTP c100 hardware token passcode doesn't work! If you generate 20 or more codes on your OTP c100 token without authenticating, your token will need to be re-synchronized with Duo. Note that a token can only be re-synchronized if it is off from the server by less than 1000 events button presses — therefore it is not advisable to repeatedly press the button on your token if you are not actually performing an authentication. To re-synchronize your token, attempt to login to a WebAuth-protected application, using your token for the 2nd factor. You will receive "invalid passcode" errors the first 2 times you attempt to login, but the third attempt will be successful. More information on token re-synchronization What can I manage about my enrollment in NetID+? You can use the “Manage your Account” page to generate new printable single-use bypass codes, or register additional devices. You can also configure your self-service support or "lifeline" options. Access to the “Manage your Account” page is itself protected with NetID+. How can I use NetID+ while on international travel? We recommend that anyone who travels internationally, and needs to log into UA systems with NetID+, generate a list of NetID+ Bypass Codes and register at least one NetID+ Lifeline. NetID Bypass Codes are generated in batches of 10 via the NetID+ self-service site; each code is good for one login, and you can generate more at any time. Your last bypass code should be used to generate a new batch of bypass codes, if you do not have access to any other enrolled device. Note If you travel internationally and use SMS passcodes as your primary NetID+ authentication mechanism, the text messages you receive may incur substantial roaming charges. If you have a Google Voice account tied to an external Gmail account not you can set that up with NetID+ as an SMS-capable phone and configure it to deliver incoming SMS messages to your Gmail mailbox. If you expect to travel internationally and cannot set up Duo Mobile as your NetID+ authentication method, bypass codes, a Yubikey hardware token, or the aforementioned Google Voice approach are your best alternatives. Why can I print my bypass codes but not my NetID password? Your password is reusable, so if someone steals it, they can keep using that password with your account over and over again. Bypass codes can only be used once and are easily invalidated if necessary. NetID+ is based on the idea of 1 something you know your password and 2 something you have your smartphone or token, or your printed codes. You should also store your bypass codes in your wallet. You're likely to always know where your wallet is and immediately notice when it's missing. That way, you can quickly invalidate your codes by simply generating a new batch, via the “Print Bypass Codes” button on the “Manage your Account” page if your wallet is stolen or lost. Also, even if it is lost, the person who steals or finds it only has your bypass codes, and can't log in without your password. Don't write down your password! If I upgrade my phone I have a new device with the same number, or reset my phone so that all data is wiped, how do I get Duo Push to work again? After reinstalling the Duo Mobile app, access the NetID+ “Manage your Account” page, using an SMS code to authenticate since Duo Push needs to be re-activated. Once you’ve logged-in, click the yellow “Re-activate” button on the affected device, and follow the on-screen instructions. I requested a passcode be sent via text message SMS to my phone and it still hasn't arrived. When I can expect it? Typically, SMS messages are delivered within a few minutes, but delivery delays can happen depending on the cell carrier's infrastructure. You can always request more passcodes via the “send more” link under the “Passcode” option on the NetID+ form. You can also generate a passcode via the Duo Mobile app on your device. I previously received a batch of passcodes via text message SMS, why aren’t they working? Passcodes must be used in the sequence in which they are presented. If you have previously received SMS passcodes, there should be a message under the “Passcode” option on the NetID+ form indicating the starting digit of the next passcode to use “Next SMS passcode starts with 2 send more”. Also, be aware that requesting a new set of passcodes via the “send more” link automatically invalidates any previous passcodes you have received. Can I use Google Authenticator with NetID+? No, you can't use Google Authenticator with NetID+. However, you can store Google's two-step verification credentials as well as any other site using TOTP, like GitHub, Dropbox, etc in the Duo Mobile app. Info on adding third-party accounts to Duo Mobile can be found at
520(520) Token Tracker on HecoInfo shows the price of the Token $0.00, total supply 520, number of holders 69 and updated information of the token. The token tracker page also
WordPress JSON Web Token Authentication allows you to do REST API authentication via token. It is a simple, non-complex, and easy to use. This plugin probably is the most convenient way to do JWT Authentication in WordPress. Support & question WordPress support forum Reporting plugin’s bug GitHub issues tracker Discord channel also available for faster response. Enable PHP HTTP Authorization Header Shared Hosts Most shared hosts have disabled the HTTP Authorization Header by default. To enable this option you’ll need to edit your .htaccess file by adding the following RewriteEngine on RewriteCond %{HTTPAuthorization} ^.* RewriteRule ^.* - [E=HTTP_AUTHORIZATION%1] WPEngine To enable this option you’ll need to edit your .htaccess file by adding the following see this issue SetEnvIf Authorization ".*" HTTP_AUTHORIZATION=$1 Configuration Configurate the Secret Key The JWT needs a secret key to sign the token. This secret key must be unique and never be revealed. To add the secret key, edit your file and add a new constant called JWT_AUTH_SECRET_KEY. define'JWT_AUTH_SECRET_KEY', 'your-top-secret-key'; You can use a string from here Configurate CORs Support This plugin has the option to activate CORs support. To enable the CORs Support edit your file and add a new constant called JWT_AUTH_CORS_ENABLE define'JWT_AUTH_CORS_ENABLE', true; Namespace and Endpoints When the plugin is activated, a new namespace is added. /jwt-auth/v1 Also, two new POST endpoints are added to this namespace. /wp-json/jwt-auth/v1/token /wp-json/jwt-auth/v1/token/validate Requesting/ Generating Token /wp-json/jwt-auth/v1/token To generate token, submit a POST request to this endpoint. With username and password as the parameters. It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed. Sample of success response when trying to generate token { "success" true, "statusCode" 200, "code" "jwt_auth_valid_credential", "message" "Credential is valid", "data" { "token" "eyJ0 "id" 1, "email" "contactjavas "nicename" "contactjavas", "firstName" "Bagus Javas", "lastName" "Heruyanto", "displayName" "contactjavas" } } Sample of error response when trying to generate token { "success" false, "statusCode" 403, "code" "invalid_username", "message" "Unknown username. Try again or check your email address.", "data" [] } Once you get the token, you must store it somewhere in your application. It can be – using cookie – or using localstorage – or using a wrapper like localForage or PouchDB – or using local database like SQLite or Hive – or your choice based on app you develop 😉 Then you should pass this token as Bearer Authentication header to every API call. The header format is Authorization Bearer your-generated-token and here’s an example "Authorization Bearer eyJ0 The jwt-auth will intercept every call to the server and will look for the authorization header, if the authorization header is present, it will try to decode the token and will set the user according with the data stored in it. If the token is valid, the API call flow will continue as always. Whitelisting Endpoints Every call to the server except the token creation some default whitelist will be intercepted. However, you might need to whitelist some endpoints. You can use jwt_auth_whitelist filter to do it. Please simply add this filter directly without hook. Or, you can add it to plugins_loaded. Adding this filter inside init or later will not work. If you’re adding the filter inside theme and the whitelisting doesn’t work, please create a small 1 file plugin and add your filter there. add_filter 'jwt_auth_whitelist', function $endpoints { $your_endpoints = array '/wp-json/custom/v1/webhook/*', '/wp-json/custom/v1/otp/*', '/wp-json/custom/v1/account/check', '/wp-json/custom/v1/register', ; return array_unique array_merge $endpoints, $your_endpoints ; } ; Default Whitelisted Endpoints We whitelist some endpoints by default. This is to prevent error regarding WordPress & WooCommerce. These are the default whitelisted endpoints without trailing * char // Whitelist some endpoints by default without trailing * char. $default_whitelist = array // WooCommerce namespace. $rest_api_slug . '/wc/', $rest_api_slug . '/wc-auth/', $rest_api_slug . '/wc-analytics/', // WordPress namespace. $rest_api_slug . '/wp/v2/', ; You might want to remove or modify the existing default whitelist. You can use jwt_auth_default_whitelist filter to do it. Please simply add this filter directly without hook. Or, you can add it to plugins_loaded. Adding this filter inside init or later will not work. If you’re adding the filter inside theme and the it doesn’t work, please create a small 1 file plugin and add your filter there. It should fix the issue. add_filter 'jwt_auth_default_whitelist', function $default_whitelist { // Modify the $default_whitelist here. return $default_whitelist; } ; Validating Token You likely don’t need to validate the token your self. The plugin handle it for you like explained above. But if you want to test or validate the token manually, then send a POST request to this endpoint don’t forget to set your Bearer Authorization header /wp-json/jwt-auth/v1/token/validate Valid Token Response { "success" true, "statusCode" 200, "code" "jwt_auth_valid_token", "message" "Token is valid", "data" [] } Errors If the token is invalid an error will be returned. Here are some samples of errors No Secret Key { "success" false, "statusCode" 403, "code" "jwt_auth_bad_config", "message" "JWT is not configured properly.", "data" [] } No HTTP_AUTHORIZATION Header { "success" false, "statusCode" 403, "code" "jwt_auth_no_auth_header", "message" "Authorization header not found.", "data" [] } Bad Iss { "success" false, "statusCode" 403, "code" "jwt_auth_bad_iss", "message" "The iss do not match with this server.", "data" [] } Invalid Signature { "success" false, "statusCode" 403, "code" "jwt_auth_invalid_token", "message" "Signature verification failed", "data" [] } Bad Request { "success" false, "statusCode" 403, "code" "jwt_auth_bad_request", "message" "User ID not found in the token.", "data" [] } User Not Found { "success" false, "statusCode" 403, "code" "jwt_auth_user_not_found", "message" "User doesn't exist", "data" [] } Expired Token { "success" false, "statusCode" 403, "code" "jwt_auth_invalid_token", "message" "Expired token", "data" [] } Available Filter Hooks JWT Auth is developer friendly and has some filters available to override the default settings. jwt_auth_cors_allow_headers The jwt_auth_cors_allow_headers allows you to modify the available headers when the CORs support is enabled. Default Value 'X-Requested-With, Content-Type, Accept, Origin, Authorization' Usage example /** * Change the allowed CORS headers. * * param string $headers The allowed headers. * return string The allowed headers. */ add_filter 'jwt_auth_cors_allow_headers', function $headers { // Modify the headers here. return $headers; } ; jwt_auth_iss The jwt_auth_iss allows you to change the iss value before the payload is encoded to be a token. Default Value get_bloginfo 'url' Usage example /** * Change the token issuer. * * param string $iss The token issuer. * return string The token issuer. */ add_filter 'jwt_auth_iss', function $iss { // Modify the "iss" here. return $iss; } ; jwt_auth_not_before The jwt_auth_not_before allows you to change the nbf value before the payload is encoded to be a token. Default Value // Creation time. time Usage example /** * Change the token's nbf value. * * param int $not_before The default "nbf" value in timestamp. * param int $issued_at The "iat" value in timestamp. * * return int The "nbf" value. */ add_filter 'jwt_auth_not_before', function $not_before, $issued_at { // Modify the "not_before" here. return $not_before; }, 10, 2 ; jwt_auth_expire The jwt_auth_expire allows you to change the value exp before the payload is encoded to be a token. Default Value time + DAY_IN_SECONDS * 7 Usage example /** * Change the token's expire value. * * param int $expire The default "exp" value in timestamp. * param int $issued_at The "iat" value in timestamp. * * return int The "nbf" value. */ add_filter 'jwt_auth_expire', function $expire, $issued_at { // Modify the "expire" here. return $expire; }, 10, 2 ; jwt_auth_alg The jwt_auth_alg allows you to change the supported signing algorithm for your application. Default Value 'HS256' Usage example /** * Change the token's signing algorithm. * * param string $alg The default supported signing algorithm. * return string The supported signing algorithm. */ add_filter 'jwt_auth_alg', function $alg { // Change the signing algorithm here. return $alg; } ; jwt_auth_payload The jwt_auth_payload allows you to modify all the payload / token data before being encoded and signed. Default value get_bloginfo'url', 'iat' => $issued_at, 'nbf' => $not_before, 'exp' => $expire, 'data' => array 'user' => array 'id' => $user->ID, ; Usage example /** * Modify the payload/ token's data before being encoded & signed. * * param array $payload The default payload * param WP_User $user The authenticated user. * . * return array The payload/ token's data. */ add_filter 'jwt_auth_payload', function $payload, $user { // Modify the payload here. return $payload; }, 10, 2 ; jwt_auth_valid_credential_response The jwt_auth_valid_credential_response allows you to modify the valid credential response when generating a token. Default value true, 'statusCode' => 200, 'code' => 'jwt_auth_valid_credential', 'message' => __ 'Credential is valid', 'jwt-auth' , 'data' => array 'token' => $token, 'id' => $user->ID, 'email' => $user->user_email, 'nicename' => $user->user_nicename, 'firstName' => $user->first_name, 'lastName' => $user->last_name, 'displayName' => $user->display_name, , ; Usage example /** * Modify the response of valid credential. * * param array $response The default valid credential response. * param WP_User $user The authenticated user. * . * return array The valid credential response. */ add_filter 'jwt_auth_valid_credential_response', function $response, $user { // Modify the response here. return $response; }, 10, 2 ; jwt_auth_valid_token_response The jwt_auth_valid_token_response allows you to modify the valid token response when validating a token. Default value true, 'statusCode' => 200, 'code' => 'jwt_auth_valid_token', 'message' => __ 'Token is valid', 'jwt-auth' , 'data' => array, ; Usage example /** * Modify the response of valid token. * * param array $response The default valid token response. * param WP_User $user The authenticated user. * param string $token The raw token. * param array $payload The token data. * . * return array The valid token response. */ add_filter 'jwt_auth_valid_token_response', function $response, $user, $token, $payload { // Modify the response here. return $response; }, 10, 4 ; jwt_auth_extra_token_check The jwt_auth_extra_token_check allows you to add extra criterias to validate the token. If empty, has no problem to proceed. Use empty value to bypass the filter. Any other value will block the token access and returns response with code jwt_auth_obsolete_token. Default value '' Usage example /** * Modify the validation of token. No-empty values block token validation. * * param array $response An empty value ''. * param WP_User $user The authenticated user. * param string $token The raw token. * param array $payload The token data. * . * return array The valid token response. */ add_filter 'jwt_auth_extra_token_check', function $response, $user, $token, $payload { // Modify the response here. return $response; }, 10, 4 ; Credits PHP-JWT from firebase JWT Authentication for WP REST API Devices utility by pesseba The awesome maintainers and contributors
. 165 148 317 367 349 257 278 209

code 520 token message token invalide data accounts