Configuring OAuth 2.0

Accessing webMethods Integration services by using OAuth 2.0

Before you begin

Before you start services by using OAuth 2.0 tokens, you must define clients, scopes, associate scopes to clients, and generate OAuth 2.0 tokens.

About this task

webMethods Integration services can be accessed through REST APIs from any REST client. In OAuth 2.0, the client gets an access token. The authorization server issues this token after the resource owner approves the request. The client uses the access token to access the protected resources. An in-depth description of OAuth is beyond the scope of this document but is available elsewhere. For information about the OAuth protocol, see the OAuth 2.0 Authorization Framework.

Procedure

  1. Define the clients that are authorized to start services in webMethods Integration. Specify the client name, version number of the client, client type, redirection URLs, allowed grants, expiration interval, and the refresh count. See the Registering Clients section for more information.
  2. Define the scope. A scope defines the services that the client can access on behalf of the resource owner. A scope consists of a name and one or more services. If access is granted for a scope, then access is granted for all the services in that scope.
  3. Associate defined scopes with the registered clients. When you associate scopes, you authorize the scopes that each client can access.
  4. Generate tokens (Access Token and Refresh Token) by using a REST Client. See the Generating Tokens section for more information.webMethods Integration supports the Authorization Code Grant, Implicit Grant, Client Credentials Grant, and the Resource Owner Password Credentials Grant to generate the access tokens. Clients use the tokens to run REST URLs for running the integrations. After you generate the tokens, the tokens are available in the Token Management page in webMethods Integration.