Authentication Login using Python code

I logged into the Genesys web API using a username, password, organization name, and a six-digit multi-factor authentication code. If I am using the Genesys Developer tool, can I log in with the following Python code using those username, password, organization name, and code? Or do I need to request a different grant from IT?

It seems that without VPN, it pops out error: 400 client not found. With VPN, it pops out error: rejected by remote users.

My Python code:

import os
import sys
import time
import PureCloudPlatformClientV2
from PureCloudPlatformClientV2.rest import ApiException

print('-------------------------------------------------------------')
print('- Execute Bulk Action on recordings-')
print('-------------------------------------------------------------')

Credentials

CLIENT_ID = "xxxxx"
CLIENT_SECRET = "xxxxx"
orgName = "xxx"
encodedsamlassertion = "xxxxxx"

ORG_REGION = "us_west_2" # eg. us_east_1

Set environment

region = PureCloudPlatformClientV2.PureCloudRegionHosts[ORG_REGION]
PureCloudPlatformClientV2.configuration.host = region.get_api_host()

body = PureCloudPlatformClientV2.EdgeNetworkDiagnosticRequest() # EdgeNetworkDiagnosticRequest | request payload to get network diagnostic
body.host = "The IP or host you want to ping"

print('connecting')

OAuth when using Client Credentials

apiclient = PureCloudPlatformClientV2.api_client.ApiClient().get_saml2bearer_token(CLIENT_ID, CLIENT_SECRET, orgName, encodedsamlassertion)
authApi = PureCloudPlatformClientV2.AuthorizationApi(apiclient)
print(authApi.get_authorization_permissions().to_json())
print('finish')

It's a bit unclear exactly what you're doing in each scenario, technically speaking.

You can find documentation on the supported OAuth grant types in this area of the site, and specifically a description of which to use when here: https://developer.genesys.cloud/authorization/platform-auth/#authorization-types.

Genesys Cloud has no knowledge of or interest in your local network connections; all public-facing Genesys Cloud APIs are exposed publicly to the internet so that is all that is required. How your IT department chooses to give you access to internet resources is up to them.

Hi Tim,

Are my username and password are the Client ID and Client Secret? Can I login developer tool via Python using my existing Client ID and Client Secret, orgName, multi-factor authentication code? Or I need to request what other permissions?

My Platform API Admin does not have OAuth option. In the tutorial, there have a Admin -> OAuth to setup OAuth login access code. But I don't have OAuth Option in the Admin page.

I logged in the Genesys via username, password, org, and a Authenticator's code, Am I using SAML2-Bearer Grant for OAuth2 authentication? Is this a good method to log in with python SDK or other SDK? Should I ask for additional grants?

Full Error message

MaxRetryError: HTTPSConnectionPool(host='login.usw2.pure.cloud', port=443): Max retries exceeded with url: /oauth/token (Caused by ProtocolError('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None)))

No. A user has a username and password. A client credentials OAuth client has a client ID and client secret. Users must use user-based OAuth flows (anything but the client credentials flow), and client credentials must use the client credential OAuth flow.

The developer tools on the Developer Center (e.g. API Explorer) uses the implicit grant. This only supports users logging in. You can find documentation about using this feature here: https://developer.genesys.cloud/devapps/about/account-switcher.

Permissions are documented with each endpoint in API Explorer. To learn more about administering permissions, see the Resource Center article About people and permissions - Genesys Cloud Resource Center.

If you don't have permissions to administer OAuth clients in your org, you will need to work with your org's administrators to get that access or to have them configure what you need for you.

That's not something I can tell you. That's something only you know by looking at the configuration of your OAuth client. Its configured type is whatever you (or someone in your org) set it as.

It depends entirely on your use case. See the link provided above for information on the different grant types and which to use when.

Thank you Tim for your quick response. I will work with my Administrators and see.

Given your comment about issues with your VPN from your original post and this error, I would recommend contacting your IT team about this to troubleshoot your network. There aren't any ongoing issues (see https://status.mypurecloud.com/), so an inability for a client to establish a connection is almost certainly not a problem on the Genesys Cloud side of the connection. Your IT team may be interested in these articles:

Hi Tim,
I don't know what I need to put for the encodedsamlassertion

apiclient = PureCloudPlatformClientV2.api_client.ApiClient().get_saml2bearer_token(client_id,
client_secret,
"companyId",
encodedsamlassertion???)

I thought it might be the Base64 encoded user/password from this page
How to Use Base 64 Encoding (genesys.cloud)

but that did not work.

Please advise. Thanks,
Greg

@Greg_Walters1 the SAML assertion comes from your SAML provider. Details on how you actually get it would be found in your SAML provider's integration documentation.

We are using Genesys Cloud CX. How do we know who are SAML provider is? Is that something internal. Sorry, I am not a security guy.

Yes, it's something you provide. You can find the documentation for SSO here: About single sign-on (SSO) - Genesys Cloud Resource Center.

If you have additional questions about implementing authorization in your app, please create a new topic with information about your inquiry. Thanks!