Power Platform Community Forum Thread Details

Are you adding the header?

Firstly let me share this

And Share this where you can see to generate the challenge

Here's a breakdown of the process:

1. Understanding the Concept

PKCE (Proof Key for Code Exchange):

PKCE is a security enhancement for OAuth 2.0 authorization code grant, designed to protect against potential vulnerabilities, especially when dealing with public clients.
Code Verifier and Code Challenge:

A code verifier is a randomly generated secret, and the code challenge is a transformed version of the code verifier, used in the authorization request.

2. Power Automate Flow Steps

Create a Power Automate Flow:
Start a new automated cloud flow in Power Automate.

Choose a trigger that suits your needs, such as "When an HTTP request is received" or "When an item is created/modified".
Generate a Code Verifier:
Add a "Compose" action to generate a random code verifier.

Use a formula like base64ToText(encodeBase64(NewGuid())) to create a random string.
Derive the Code Challenge:
Add another "Compose" action to derive the code challenge.

Use a formula like sha256(base64ToText(encodeBase64(outputs('Compose_1').body))) to perform the SHA256 hash of the code verifier.
Store the Code Verifier:
Add a "Create file" action to store the code verifier securely.
Prepare the Authorization Request:
Add an "HTTP" action to make the request to the ServiceNow authorization endpoint.

Configure the request with:

Method: POST

URL: ServiceNow's authorization endpoint URL

Headers:

Content-Type: application/x-www-form-urlencoded

Authorization: Bearer <your_bearer_token> (if applicable)

Body:

client_id=<your_client_id>

redirect_uri=<your_redirect_uri>

scope=<your_scope>

code_challenge=<code_challenge>

code_challenge_method=S256

state=<your_state> (optional, for tracking)
Handle the Response:
Add actions to handle the response from ServiceNow, such as:

Extracting the authorization code from the response

Sending the authorization code to the next step in your flow

Storing the authorization code for later use

3. ServiceNow Configuration

OAuth 2.0 Application:
- Create an OAuth 2.0 application in ServiceNow.
- Configure the application with:
  - Client ID: The client ID for your application
  - Client Secret: The client secret for your application
  - Redirect URI: The URL where ServiceNow will redirect the user after authorization
  - Scope: The permissions your application needs
Authorization Endpoint:
- Note the authorization endpoint URL for your ServiceNow instance.