OAuth or OpenID Scopes

Edit online

Before you begin

You must have the webMethods API Gateway's manage security configurations functional privilege assigned to manage scopes.

About this task

You have to map the scope that you have defined in the authorization server with the APIs in webMethods API Gateway to authorize the access tokens to be used to access the protected resources. You can map either a complete API or parts (resources or methods) of an API to the scope.

For example, if there is a scope you have defined for an external authorization server, such as readonly, then the access tokens which contain readonly as their scope, should access only the GET resources. So, you can create an API Scope for the GET resources in an API or for multiple APIs and then map this readonly scope to all those API Scopes. Now this access token can invoke only the GET resources. If it tries to invoke any POST or PUT resource it fails. As another example you can consider mapping a business scope such as, inventory, that you have defined in the authorization server; you can map all the resources required for the inventory business to this scope.

To map a scope

Procedure

  1. Expand the menu options icon , in the title bar, and select OAuth/OpenID scopes.
  2. Click Map scope.
  3. Provide the following information in the Authorization server scope section:
    Field Description
    Select authorization server scope Specifies the scope linked to the authorization server.

    Type a search word and select the required scope from the search list populated.

    Name Displays the name of the authorization server scope selected. This is populated by default and is non-editable.
    Description A brief description for the scope being mapped.
    Audience Provide a value or URI, the intended recipient of the authorization server scope.

    The application that receives the token verifies that the audience value is correct and rejects any tokens intended for a different audience.

  4. Click API scopes.
  5. Specify an API scope that is to be linked to the authorization server.
    Alternatively, you can type a search word and select the required API scope from the search list populated.
    The API scopes added are listed in the Selected API scopes table. You can click the delete icon , in the corresponding column, to delete an API scope from the list.
  6. Click Save.

Results

This maps the authorization server scope to the selected API scopes and lists the authorization scope in the scopes list.