# C8Y Microservice | Python Flask | Authentication issues

**URL:** <https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493>\
**Category:** Forum\
**Tags:** microservice, authentication, python, cumulocity\
**Created:** [September 5, 2024, 2:16am UTC](https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493 "2024-09-05T02:16:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kristopher.takken](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kristopher.takken](https://community.cumulocity.com/u/kristopher.takken)\
**Post date:** [September 5, 2024, 2:16am UTC](https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493/1 "2024-09-05T02:16:16Z")

</div>

# Problem Statement

I have tried multiple authentication methos within my Microservice with mixed results.

- For Subscriptions I can get it to work with Auth in the header (base64 encoded) `requests.post(subscription_url, json=subscription_data, headers=headers)`

- For Tokens I can get it to work with Auth directly (basic username, password) `requests.post(token_url, json=token_data, auth=(username, password))`

- For Quering the database I can only get it to work with my personal credentials in the header (base64 encoded), 403 with C8Y ENV credentials `response = requests.get(url=f"{BASE_URL}/inventory/managedObjects/{id}", headers={"Accept": "application/json","Content-Type": "application/json","Authorization": f"Basic [personal Base64 Credentials]"})`

## Outcome

**I am after:**

- a clear guidance to centralize the auth methods
- an understanding of the auth architecture and process for microservices
- links to relevant documentation that clearly states the required auth method for:
  - Subscription
  - Token
  - Standard DB Query

# Example Code:

## Ideal Auth Method:

```python
tenant = os.getenv('C8Y_TENANT')
user = os.getenv('C8Y_USER')
password = os.getenv('C8Y_PASSWORD')
BASE_URL = "http://cumulocity:8111"
username = f"{tenant}/{user}"
credentials = f"{username}:{password}"
encoded_credentials = base64.b64encode(credentials.encode()).decode()

headers = {
    "Accept": "application/json",
    "Content-Type": "application/json",
    "Authorization": f"Basic {encoded_credentials}",
}

```

## Subscription (Pass)

```python
response = requests.post(subscription_url, json=subscription_data, headers=headers)

```

## Token (Pass)

```python
response = requests.post(token_url, json=token_data, auth=(username, password))

```

## Managed Object

> Auth in Header Personal Credentials (Pass)

```python
response = requests.get(url=f"{BASE_URL}/inventory/managedObjects/{id}", headers={"Accept": "application/json","Content-Type": "application/json","Authorization": f"Basic [personal Base64 Credentials]"})

```

> Auth in Header (Fail)

```python
response = requests.get(url=f"{BASE_URL}/inventory/managedObjects/{id}", headers={"Accept": "application/json","Content-Type": "application/json","Authorization": f"Basic encoded_credentials"})

```

Response (info URL provided is not valid)

```http
{
  "error": "security/Forbidden",
  "message": "Access is denied",
  "info": "https://www.cumulocity.com/guides/reference/rest-implementation//#a-name-error-reporting-a-error-reporting"
}

```

> Auth Directly (Fail)

```python
response = requests.get(url=f"{BASE_URL}/inventory/managedObjects/{id}",auth=(username, password))

```

Response (info URL provided is not valid)

```http
{
  "error": "security/Forbidden",
  "message": "Access is denied",
  "info": "https://www.cumulocity.com/guides/reference/rest-implementation//#a-name-error-reporting-a-error-reporting"
}

```

---

<div class="post-metadata">

**Author:** ![kristopher.takken](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kristopher.takken](https://community.cumulocity.com/u/kristopher.takken)\
**Post date:** [September 5, 2024, 3:51am UTC](https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493/2 "2024-09-05T03:51:40Z")

</div>

# Solved with Roles

cumulocity.json

```json
{
    "apiVersion": "1",
    "version": "0.0.1",
    "provider": {
        "name": "Cumulocity"
    },
    "isolation": "PER_TENANT",
    "requiredRoles": [
        "ROLE_NOTIFICATION_2_ADMIN",
        "ROLE_INVENTORY_ADMIN",
        "ROLE_INVENTORY_CREATE",
        "ROLE_INVENTORY_READ",
        "ROLE_MANAGED_OBJECT_ADMIN",
        "ROLE_MANAGED_OBJECT_CREATE",
        "ROLE_MANAGED_OBJECT_READ",
        "ROLE_MEASUREMENT_ADMIN",
        "ROLE_MEASUREMENT_READ",
        "ROLE_ALARM_ADMIN",
        "ROLE_ALARM_READ",
        "ROLE_DEVICE_CONTROL_READ",
        "ROLE_EVENT_ADMIN",
        "ROLE_EVENT_READ",
        "ROLE_GENERIC_MQTT_ADMIN",
        "ROLE_IDENTITY_READ"
    ],
    "roles": [
    ]
}

```

---

<div class="post-metadata">

**Author:** ![Christoph\_Souris](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christoph_souris/32/5464_2.png) [@Christoph\_Souris](https://community.cumulocity.com/u/Christoph_Souris)\
**Post date:** [September 5, 2024, 7:36am UTC](https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493/3 "2024-09-05T07:36:44Z")

</div>

To get back to your initial question. PER\_TENANT micro services authenticate themselves at Cumulocity Core using credentials injected into the running container. See also [General aspects - Cumulocity IoT Guides](https://cumulocity.com/guides/microservice-sdk/concept/#authentication-and-authorization)

It gets more complicated for multi tenant microservices - there you’d have to extract the access credentials from the inbound requests into Flask in your example.

As you are using Python, you may have a look at this framework [c8y-api · PyPI](https://pypi.org/project/c8y-api/) which handles all these topics nicely and provides a pythonic interface to the REST API.  
Disclaimer: I’m the author of this project.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [March 4, 2025, 7:36am UTC](https://community.cumulocity.com/t/c8y-microservice-python-flask-authentication-issues/2493/4 "2025-03-04T07:36:46Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.