Setting up OAUTH 2.0 Authorization

OAuth enables you to authorize apps by generating an Access Token and then by verifying this access token which is generated instead of relying on a specific password.

This section explains steps to set up Client Credentials grant type among the four grant types mentioned in OAuth 2.0 specification. In this grant type, the client can request an access token using only its client credentials (consumer key and secret)

You have come across the topics related to OAUTH in two sections of this document so far:

• OAuth Token End Point
• Under the "Secure API with" option in the From REST/HTTP Service section
  

Now, go through the below sections to know how to use OAUTH mentioned in the above sections

Configuring OAUTH Token End Point

To configure OAUTH Token End Point, first step is to create a project using OAUTH Token Endpoint. 

Create an OAUTH Token End Point project

From the API Dashboard, click API Projects - Manage API Projects and select OAuth Token End Point option from Add API Project drop-down present in the upper-right part of the API Projects panel.

Figure 1: Providing attributes to create OAuth Token End Point Project

Following values are used in the above figure as a sample:

After creating the project, double-click the AccessToken project to get into the project. Notice the below configuration settings that takes place automatically:

a) Go to Policies section to check that the OAUTH Token End Point Policy is set.

Figure 2: OAuth Token End Point Policy Configuration auto-populated

b) Go to Resources section to check that the OAUTH Token End Point Policy is added to the Proxy Request endpoint.

Figure 3: OAuth Token End Point Policy added to Proxy Request endpoint in Resources

Deploy the OAUTH Token Endpoint project

Now deploy the project; select AccessToken project, click the Deploy button and then choose the Environment of your choice.

This project acts as an endpoint to generate access tokens. Publish this to clients for obtaining tokens.

Enabling OAUTH security for Protected API Resources 

Now that the Access Token Endpoint is ready to receive requests from the clients with valid registration, create a OAuth Verify Access Token policy and attach it to the Proxy Request endpoint of the resource. You can do this while creating a project as well as to the existing one.

While creating a project

While creating a new REST/HTTP or WSDL project, choose the "OAuth 2.0 Access Tokens" option for the Secure API with property.

Figure 4: Choosing to apply OAuth Access Token while creating a project

Open the project and notice the following configuration settings that takes place automatically:

a) Go to Policies section to check that the Verify Token Policy configuration is set.

Figure 5: OAuth Verify Access Token Policy added to Proxy Request endpoint in Resources

b) Go to Resources section to check that the Verify Token Policy is added to the Proxy Request endpoint.

Figure 5: OAuth Verify Access Token Policy Configuration Auto -populated

To an existing project

You need to manually add the policy and attach it to the resource while working with an already existing  project.

Refer the Adding Policy to the Project section and the previous section OAUTH 2.0  to add OAuth Verify Access Token policy and manually select Query option as the accesstoken location.

Go to Resources section, click the Proxy Request endpoint in the DefaultResource and add the OAuth Verify Access Token policy by clicking the Edit  button and then using the left arrow  button.

Figure 6: Adding the Verify Access Token policy to Resources after manual configuration

Configuring Client Subscription and Generating API Key

Now create a product and add the OAuth secured API project to it, create a Client and then create Client Subscriptions. To do this, use Apps - Manage API Products and Client Subscriptions prompt in the Dashboard and follow the steps mentioned in the Adding Products, Clients and Client Subscriptions section.

After creating the Client Subscription with the product, Generate Consumer Key and Consumer Secret.

Figure 7: Generating Consumer Key and Consumer Secret

By this, the set up from the API Dashboard is over and the client may be provided with the keys that are generated for their communication.

Obtaining access token from Token Endpoint

Now, when the client sends a request which carries a valid Consumer Key and Consumer Secret to the Token End Point in order to get an access token, the Token End Point verifies the credentials and returns the access token back to the client. 

To send the request using Postman, provide the following values in the postman and click Send button:

• Method: POST
•  URL: Project proxy URL
• Header
  • name: grant_type
  • Value: client_credentials
• Parameter Format: x-www-form-urlencoded
• Parameters
  • Client_id (Consumer Key generated from Client Subscription)
  • Client_secret (Consumer Secret generated from Client Subscription)

When a valid request is sent, access token is generated as shown in the above figure.

Accessing protected resources using access token

After receiving the Access Token, it is sent along with the request as a query parameter(since Query is set in VerifyAccessTokenPolicy) to access the protected API. Now the request URL will be in the following format: