Python API 3.3.1 is out

Hi @dietmar.kreider

First, please allow me to correct you : a new ShotGrid account on a site using Autodesk Identity does NOT use the Autodesk Identity credentials.

New users are created with a login that match their email (if that login is not already taken), and does not have a password (passphrase) set. It is the user that decides what it is. Obviously, picking the same password as your Autodesk Identity user is possible but definitely not mandatory. A user will not be able to leverage a Personal Access Token (PAT) associated with their user if there is not a passphrase set by them.

Now regarding your question: there are currently no such plans.

As things currently stands, logging into Autodesk Identity with credentials can only be done via a web-like environment. There are no ways to send your credentials over-the-wire via a simple API call.

Autodesk Identity supports its own 2FA mechanism, which would make it more difficult to connect directly via an API if such a thing existed. But Autodesk Identity also allows company to tie in their own SSO backend to the authentication process. Effectively making it nearly impossible (due to the variety of IdPs available) to define an API that would provide a unified solution.

This is why the idea of a PAT came on the scene: it is recognized by Autodesk Identity as identifying a specific user and allows code to exchange it for a session token. To make things safer, the PAT is kept in ShotGrid and it is the only one that can make the request to exchange it for a session token.

When using a PAT, you should see ShotGrid as a password manager: you need to enter valid credentials to unlock it. Doing things this way is safer than having user handle the PAT and pass it along. There are two levels of control/revocations : you can change your passphrase in ShotGrid or delete the PAT from your security settings on profile.autodesk.com.

Another reason for having a PAT : it ensured that no software update was needed for your applications/scripts when your site transitioned to Autodesk Identity. If an artist was able to connect on day - 5, they would also be able to connect on day + 5 (provided a PAT was set)

So we understand the potential discomfort of having a different set of credentials between Autodesk Identity and the ShotGrid legacy username/passphrase, but the benefits seemed to outweigh the drawbacks.

At this time, a user can set their passphrase to match their Autodesk Identity password. But there is a bug (which is currently being actively worked on) where a ShotGrid admin cannot change an existing user’s login.

Once that is fixed, there will be the possibility to have credentials that matches between ShotGrid and Autodesk Identity, though it would rightfully be argued that this may be a security risk.

Should you want to use really use your Autodesk Identity credentials to authenticate with a script, you can get an insight on how to do that from this post: Python API/Rest API and authentication with SSO enabled

Hoping my explanation to be satisfactory,

-Patrick