undefinedError from token exchange: Bad authorization header scheme

[bbrazeau]

I am attempting to create a custom connector to a 3rd party provider and use Flow to send over data.  Their API uses tokens when making calls, but the tokens are SINGLE USE.  So the pattern is:
Send Auth information.  Get Token
Make Call using Token.

Send Auth information.  Get Token
Make Call using Token.

....

Not brilliant.

I used swagger hub and can make calls successfully.  When I try to test the Custom Connector I can make the Auth call but the Lookup call fails with the error about a Token Exchange.

Security Tab - No Authentication
API doesn't work because the Authorization token changes every single call.  Can't cache anything.

Definition Tab -
Auth Token - Post -   Body of message is {API Key, UserName, Password}

LookupEmployees - Get - 2 Query parameters and the Header should be Authorization: BDToken <value>

Testing the Calls -

Auth Token works.  The request is sending along a Bearer token which it shouldn't but its not failing so <shrug>

And it returns a token as expected.

 

I copy the token into the Lookup Employees call and it fails.  They relabel token to BDToken in their call but it gets pasted in correctly.  The Bearer token from the above step goes away and the query string parameters (disp, SearchDate) are sent along as expected.

 

But the response is a failure because of the 'Token Exchange'.  Which I'm not familiar with.

To prove the call does work, I generated a new token and called the same endpoint in Swagger - the date is encoded the same, disp is still complete and the header has the BDToken.

Any suggestions I can test?

[v-yamao-msft]

Hi @bbrazeau,

How is your swagger file configured? Please share more details on your swagger file.

Have you tried to create a custom connector form a Postman collection?

Please take the following doc for more details:

https://docs.microsoft.com/en-us/connectors/custom-connectors/define-postman-collection

Best regards,

Mabel Mao

[bbrazeau]

I've made the current swagger API public so you can view it online as I can't attach files.

https://app.swaggerhub.com/apis-docs/a-p/BirdDogHR/1.0.0

Its a rough draft as I'm attempting to prove I can make round trips before building all of the end points.  While you won't be able to get data back, the calls can be tried showing the parameters sent etc.

I attempted to create a custom connector via postman output from the link.  I am able to make the Authorization call to get a token, but the call to get Employees is still failing.  It works in Postman, just not in the custom connector.  The Postman Connector definition has the query string parameters, but it does not include a field to set the Header Token value ("Authorization").  The Token is in the postman.json file, but its not surfaced in the custom connector.  I can send along the json or provide links to the custom connectors if that helps.

Here is a snippet of the postman.json file for the GetEmployee call

	"requests": [
		{
			"id": "15fb28a7-6189-4cae-9302-cdafa4fdb412",
			"name": "Get Employees",
			"url": "https://api.birddoghr.com/v2/Employees?disp=complete&searchdate=9/18/2018",
			"description": "Get list of Employees",
.......
			"headerData": [
				{
					"key": "Authorization",
					"value": "BDToken NmNhZjQ....Mg==",
					"description": "",
					"enabled": true
				}
			],
			"method": "GET",
			"pathVariableData": [],
			"queryParams": [
				{
					"key": "disp",
					"value": "complete",
					"equals": true,
					"description": "",
					"enabled": true
				},
				{
					"key": "searchdate",
					"value": "9/18/2018",
					"equals": true,
					"description": "",
					"enabled": true
				}
			],
.............

Postman created connector - Header is not surfaced so I can't set the value -

In the Swagger Custom Connector the Header for Authorization is visible.

I've attempted to test the (Swagger created) connector in a flow

https://us.flow.microsoft.com/manage/environments/Default-894e6e86-f15c-4b68-8774-f442d24db0d3/flows...

In that example I can make the call and generate a token. Calling GetEmployees and sending along the Token fails. Because it returns 'unauthorized' the run history won't even show what was sent so troubleshooting there is impossible.