topic Re: Load an a360 model without user auth in Fusion Educators (Read-Only)

Load an a360 model without user auth

Anonymous — Wed, 06 Jul 2016 18:05:18 GMT

I would like to serve different models from my a360 depending on parameters, but without any kind of auth from the user. Is it possible to achieve this at the moment?

I want to render a model from my a360 bucket and I've read that if I want to use the Data Management API I need to use 3-legged auth.
However, I want the user to see that model, which is in my a360, but I don't want the user to have access to my account or even have an account.

Re: Load an a360 model without user auth

philippe.leefsma — Fri, 08 Jul 2016 08:26:02 GMT

The 3-legged oauth authorization mechanism is designed to let your application (an application in general) access resources from a specific user account once it has been authorized through a web page.

In your case you want to serve data from your account to other users of your app, so what you would need to do is first get a valid auth token for your account, you can hardcode it in your server, then your application will refresh this token "forever" based on its expiracy period so it remains authorized.

Once you have a valid token (with full privileges - if needed), you can request a downgraded token (a token with limited scope, e.g only for data:read) which can be sent to a client app in the browser so it will be allowed to load that model from your account. Users will not be able to perform any other create/write operations on your account if they grab that token, however they could load any model may they know their URN's.

You can take a look at my sample there, which implement downgrade scope logic to pass read-only token to the client.

Let us know if you have further questions

Regards,

Philippe.

Re: Load an a360 model without user auth

Anonymous — Tue, 12 Jul 2016 07:27:46 GMT

Thanks Philippe. It took me a while as I didn't know I had to get a token for the acmsession to permission to access to the resource from a360.
Is this documented anywhere? I couldn't find it

Re: Load an a360 model without user auth

philippe.leefsma — Tue, 12 Jul 2016 08:05:40 GMT

A360 API is a 3-legged OAuth authentication mechanism, this requires you to acquire a valid token with relevant scope based on the kind of operation you want to perform (read-only, read/write, ...) this is definitely documented at the same location than all our web APIs, the Data Management (A360) section is available there: https://developer.autodesk.com/en/docs/data/v2

Re: Load an a360 model without user auth

Anonymous — Tue, 12 Jul 2016 08:11:52 GMT

Thank you Philippe,

Maybe I wasn't clear enough. I wasn't talking about the token, I mean't the call to:

https://developer.api.autodesk.com/oss-ext/v1/acmsessions

https://stackoverflow.com/questions/37835178/creating-a-viewer-application-with-an-urn-from-autodesk-a360

Re: Load an a360 model without user auth

philippe.leefsma — Tue, 12 Jul 2016 08:37:25 GMT

It is not documented because the recommended way to to translate the file again using your credentials and not use the acmsession Id, I am not sure this approach will remain valid in the future, let me check with the development team and I will get back to you.

By the way, for logging new threads, please prefer StackOverflow as we progressively migrate all our support there.

Regards,

Philippe