(r4) ELMAndOAuth20WithOIDCProvider < Deployment

Engineering Lifecycle Management Wiki - Deployment

Community information and contribution guidelines

~~EditAttach~~Printable

TWiki > Deployment Web > DeploymentInstallingUpgradingAndMigrating > JazzAuthorizationServer > ELMAndOAuth20WithOIDCProvider

Revision 4 - 2020-12-03 - 09:53:43 - ShubjitNaik

<div id="header-title" style="padding: 10px 15px; border-width:1px; border-style:solid; border-color:#FFD28C; background-image: url(<nop>https://jazz.net/wiki/pub/Deployment/WebPreferences/TLASE.jpg); background-size: cover; font-size:120%">
---+!! OAuth2.0 Access flow on ELM Configured with Third Party OIDC Provider <img src="https://jazz.net/wiki/pub/Deployment/WebPreferences/todo.png" alt="todo.png" width="50" height="50" align="right"> 
%DKGRAY% Authors: Main.ShubjitNaik <br>
Build basis: Engineering Lifecycle Management Solution 7.0.2 and Higher
%ENDCOLOR%</div></sticky>

<!-- Page contents top of page on right hand side in box -->
<sticky><div style="float:right; border-width:1px; border-style:solid; border-color:#DFDFDF; background-color:#F6F6F6; margin:0 0 15px 15px; padding: 0 15px 0 15px;">
%TOC{title="Page contents"}%
</div></sticky>

<sticky><div style="margin:15px;"></sticky>

When deployed with Jazz Authorization Server (IBM Liberty !OIDC feature) ELM supports !OAuth 2.0. Refer the article [[ELMAndOAuth20][ELM and OAuth 2.0]] to understand how to use !OAuth2.0 protocol flow with ELM deployed with Jazz Authorization Server.

You can further configure the Jazz Authorization Server to delegate the user authentication to your standard, corporate !OIDC provider using the Liberty *Social Login* feature. Refer this article - [[JASandOIDCProvider][Configuring ELM Authentication with a third Party OIDC provider]]. The limitation being it works only with Browser based clients.

Starting ELM and JAS version 7.0.2, Non-Web clients can work with [[https://openliberty.io/blog/2019/09/13/microprofile-reactive-messaging-19009.html#oidc][Liberty Application Passwords.]] The Liberty application password feature is a way to circumvent the limitation by using a web browser to handle an identity provider's authentication scheme and producing a relatively long-lived token that can then be used by the native client (non-browser) in a simpler protocol that does not depend on the client being a web browser. The Application Passwords are supported only when JAS is delegating authentication further to a !SAML IDP or an !OIDC Provider.

The focus of this article is on how to use the application password with an !OAuth2.0 protocol flow to access ELM Protected resources.

---++  !OAuth 2.0 - A Quick Intro

!OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

[[https://tools.ietf.org/html/rfc6749#section-1.4][Access tokens ]]are credentials used to access protected resources. An access token is a string representing an authorization issued to the client. The string is usually opaque to the client. Tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server.

An [[https://tools.ietf.org/html/rfc6749#section-1.3][authorization grant ]]is a credential representing the resource owner's authorization (to access its protected resources) used by the client to obtain an access token.  This specification defines four grant types and we will focus on the [[https://tools.ietf.org/html/rfc6749#section-4.3][Password]]Grant Type.

For further details on the workflow on !OAuth2.0 and different grant types review the !OAuth 2.0 Framework at [[https://oauth.net/][OAuth 2.0 ]]

In the next section we introduce how to register a new Client in Jazz Authorization Server which is configured with a Third Party OIDC Provider and access ELM Protected resources via the Password grant type.

---++  Configuring Application Passwords in JAS

---++  Accessing ELM Protected Resources via Password Grant Type

---+++ Heading 2 (use sentence-style capitalization)

Sub-Section text Sub-Section text  Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text

---+++ Heading 2 (use sentence-style capitalization)

Sub-Section text Sub-Section text  Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text Sub-Section text

---++ Heading 1

---+++++!! Related topics: [[DeploymentWebHome][Deployment web home]], [[DeploymentWebHome][Deployment web home]]

---+++++!! External links:          

   * [[https://www.ibm.com][IBM]]

---+++++!! Additional contributors: Main.TWikiUser, Main.TWikiUser

<sticky></div></sticky>

Copyright © by IBM and non-IBM contributing authors. All material on this collaboration platform is the property of the contributing authors.
Contributions are governed by our Terms of Use. Please read the following disclaimer.
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.