Exact Online Automating Login

Question

I tried automating the login for Exact Online using the c# HttpClient. I am stuck at the form to fill in the one time password. Generating the OTP is easy, I took the DEVICE_SECRET_KEY during the first time login and stored that secret.

The code to generate this password is correct. When I use the website using username + password + generate a key. I can login. I would really like to automate this process. Does anyone see the flaw I made?

I am currently using selenium. That works, but I that would require a firefox installation on a production server. Which I would rather not do.

This is my code. Step 1 => step 2 works, the username + password are sent correctly. The second step, entering the key and getting to the redirecturl does not seem to work.

using System;
using System.Collections.Generic;
using System.Net;
using System.Net.Http;
using System.Threading;
using System.Threading.Tasks;
using HtmlAgilityPack;
using HtmlAgilityPack.CssSelectors.NetCore;
using OtpNet;

namespace Om.Finance.TotpGenerator
{
    class Program
    {
        static void Main(string[] args)
        {
            using (var client = new HttpClient())
            {
                //step 1 initial call to get CSRFTOKEN
                var url1 = "https://start.exactonline.nl/api/oauth2/auth/?client_id=_______&redirect_uri=_____&response_type=code";

                var logInScreen = client.GetStringAsync(url1 + "&force_login=1").Result;
                
                var loginDoc = new HtmlDocument();
                loginDoc.LoadHtml(logInScreen);
                var csrfToken = loginDoc.DocumentNode.QuerySelector("input[name='CSRFToken']").GetAttributeValue("value", "");
                var viewState = loginDoc.DocumentNode.QuerySelector("input[name='__VIEWSTATE']").GetAttributeValue("value", "");
                var viewStateGenerator = loginDoc.DocumentNode.QuerySelector("input[name='__VIEWSTATEGENERATOR']").GetAttributeValue("value", "");
                var eventValidation = loginDoc.DocumentNode.QuerySelector("input[name='__EVENTVALIDATION']").GetAttributeValue("value", "");

                //first a get to retrieve the CSRFToken and all other post variables
                //then post the data to the url
                
                var postVariables = new Dictionary
                {
                    { "CSRFToken", csrfToken },
                    {"sysFocus", ""},
                    {"_Division_", "1"},
                    {"__VIEWSTATE", viewState},
                    {"SysNoBack", "1"},
                    {"__VIEWSTATEGENERATOR", viewStateGenerator},
                    {"__EVENTTARGET", ""},
                    {"__EVENTARGUMENT", ""},
                    {"__EVENTVALIDATION", eventValidation},
                    {"Attempts", "0"},
                    {"Action", "0"},
                    {"UserNameField", "USERNAME"},
                    {"PasswordField", "PASSWORD"},
                    {"LoginButton", "Inloggen"},
                    {"hf2StepLoginStep", "0"},
                };
                
                //post to url1
                var otpInput = client.PostAsync(url1, new FormUrlEncodedContent(postVariables)).Result;
                
                //process this page as well
                var keyInput = new HtmlDocument();
                keyInput.LoadHtml(otpInput);
                csrfToken = keyInput.DocumentNode.QuerySelector("input[name='CSRFToken']").GetAttributeValue("value", "");
                viewState = keyInput.DocumentNode.QuerySelector("input[name='__VIEWSTATE']").GetAttributeValue("value", "");
                viewStateGenerator = keyInput.DocumentNode.QuerySelector("input[name='__VIEWSTATEGENERATOR']").GetAttributeValue("value", "");
                eventValidation = keyInput.DocumentNode.QuerySelector("input[name='__EVENTVALIDATION']").GetAttributeValue("value", "");
                var division = keyInput.DocumentNode.QuerySelector("input[name='_Division_']").GetAttributeValue("value", "");
                
                var key = Base32Encoding.ToBytes("FROM THE QRCODE TO SCAN ON FIRST LOGIN");
                var totp = new Totp(key);
                var rst = totp.ComputeTotp();
                Console.WriteLine(rst);
                
                var postVariables2 = new Dictionary
                {
                    { "CSRFToken", csrfToken },
                    {"sysFocus", ""},
                    {"_Division_", division},
                    {"__EVENTTARGET", ""},
                    {"__EVENTARGUMENT", ""},
                    {"__VIEWSTATE", viewState},
                    {"SysNoBack", "1"},
                    {"__VIEWSTATEGENERATOR", viewStateGenerator},
                    {"__EVENTVALIDATION", eventValidation},
                    {"Attempts", "0"},
                    {"Action", "0"},
                    {"ResponseTokenTotp$Key", rst},
                    {"LoginButton", "Inloggen"},
                    {"hf2StepLoginStep", "0"},
                };
                
                var response2 = client.PostAsync(url1, new FormUrlEncodedContent(postVariables2)).Result;
                //response2 should contain a REQUEST MESSAGE TO THE CALLBACK URL, INSTEAD IN BACK AT ENTERING the OTP

            }
        }
    }
}

Exact Online Automating Login

Answers (1)

Related Questions