OAuth

An OAuth policy performs the requested OAuth processing based on the defined OAuth provider settings.

Gateway support

Table 1. Table showing which gateways support this policy, and the corresponding policy version
Gateway Policy version
DataPower® API Gateway 2.0.0

This topic describes how to configure the policy in the assembly user interface; for details on how to configure the policy in your OpenAPI source, see oauth.

About

By adding an assembly OAuth policy, you specify the OAuth provider settings to use to perform the requested OAuth processing and the supported OAuth processing components.

Note: You add an OAuth policy to the assembly in a native OAuth provider. For more information, see the following topics:
You can specify the settings through one or more of the following methods.
  • URL reference
  • Literal configuration
  • Object reference
When you use more than one method to specify the same aspect of the OAuth provider settings, the following precedence rules apply to enforce the settings dynamically for the incoming transactions.
  • URL reference takes precedence over any existing literal configuration or object reference.
  • Literal configuration takes precedence over any existing object reference.
You can configure the policy to support one or more of the following processing components:
Validate request
Validates the authorization request from the client.
Generate authorization code
Generates the authorization code for the client, which represents the resource owner's authorization that grants access to the requested resource.
Verify authorization code
Verifies the authorization code from the client.
Verify refresh token
Verifies the refresh token that is presented by the client.
Generate access token
Generates the access token to the client when the authorization code or refresh token is verified.
Introspect token
Introspects the token to determine its state and, when active, its metadata.

When the policy does not support a processing component but that processing is requested, the unsupported component is not run.

You can include multiple OAuth policies in your OAuth provider assembly. For example, your assembly might include the following flow:
  1. OAuth policy that validates the request.
  2. GatewayScript policy.
  3. OAuth policy that generates authorization code.
For more information, see Example - using multiple OAuth policies in an OAuth provider assembly and OAuth context variables.

Properties

The following table lists the policy properties, indicates whether a property is required, specifies the valid and default values for input, and specifies the data type of the values.

Table 2. OAuth policy properties
Property label Required Description Data type
Title No The title of the policy.

The default value is oauth.

 string
Description No A description of the policy string
Default OAuth Provider Settings Object Yes The name of an existing OAuth provider that defines the required settings. string
Dynamic OAuth configuration from a URL No A URL to a document that contains serialized XML or JSON properties that defines OAuth token generate settings. string
Dynamic OAuth configuration from a literal string No A literal string that contains serialized XML or JSON properties that defines OAuth token generate settings. string
Supported OAuth components No Select the OAuth components that are supported by this policy. string

Overriding the default OAuth provider settings

You can use either the Dynamic OAuth configuration from a literal string property or the Dynamic OAuth configuration from a URL property to dynamically override any OAuth provider configuration settings defined by the Default OAuth Provider Settings Object property.

For example, to override the access token expiration time with a value of 200 seconds, include the following configuration in either the literal string or the document at the specified URL:
<OAuthProviderSettings><APICAccessTokenTTL>200</APICAccessTokenTTL></OAuthProviderSettings>

For a list of all OAuth provider settings, refer to the OAuthProviderSettings management schema, defined in the xml-mgmt.xsd file located in the store: directory on the DataPower API Gateway.

If you are using the API Manager user interface, the connection details are determined by the API Manager URL that you open, and the user ID with which you log in. If you are using the API Designer user interface, you provide the management server details and user ID in the login window that opens when you first launch API Designer; see Logging into API Connect Designer.