Configuring user security for a native OAuth provider

Define the settings to use to extract the application users’ credentials, authenticate their identities, and grant authorization.

Perform the following steps to configure the user security settings for the OAuth Provider:

1. Click User Security in the sidebar menu.
2. Specify the following parameters for User Security. Define the settings to use to extract the application users’ credentials, authenticate their identities, and grant authorization. User Security is not required for the Application or Resource owner - JWT grant types. Click Next when done.

   Field	Description
   Identity Extraction	Determines how the user credential is extracted: Basic Authentication - HTTP basic authentication (requires no additional configuration) Default HTML Form - Use default login form for user name and password Context variable - Specify which variable contains the user name and password. API Connect OAuth context variables as listed here API Connect context variables Custom HTML Form - Enter the endpoint and select an optional TLS profile for a custom HTML form. For instructions on creating a custom form, see Creating a custom HTML login form for user security. Redirect - If you select Redirect , enter the following parameters: End Point - Enter an endpoint to redirect to a third-party identity provider. For more information, see Authenticating and authorizing through a redirect URL Optional: Query parameters - Enter the query parameters. Query parameters are part of the URL come after the question mark (?) symbol, usually consisting of key-value pairs separated by ampersand symbol (&). Note: To ensure the query parameters that you entered is applied to the gateway, republish your OAuth provider. Redirect time limit - The user must verify their identity and return to the main authorization process within the specified redirect time limit. If the user exceeds this time limit, the process might fail or restart. The default redirect time limit is 300. You can adjust this duration based on your requirements. Disabled - do not collect the user credential Note: If you use either the Default HTML Form or Redirect identity extraction methods, the response from the redirect endpoint must maintain the order of the query parameters before the state_nonce query parameter, otherwise the authorization fails.
   Authentication	Authenticate application users with a user registry. Select an LDAP or Authentication URL user registry or create the SampleAuthURL User Registry.
   Authorization	Various methods may be used to authorize application users. For a DataPower® API Gateway, the following methods for extracting the user credential are available: Authenticated - Authorize authenticated users automatically. Default HTML Form - Use default HTML form to authorize. If you select the Default HTML Form method, all scopes that are specified in the Scopes settings are added automatically to the authorization consent form. Custom HTML Form - Enter the endpoint and select an optional TLS profile for a custom HTML form. Disabled - Disable authorization.

3. Click Save when done.