--- title: HTTP OAuth2 Authorization Mechanism description: The HTTP OAuth2 Authorization Mechanism is used to define OAuth2 authorization using an introspection (RFC7662) compliant authorization server. component: pingds version: 8.1 page_id: pingds:configref:objects-http-oauth2-authorization-mechanism canonical_url: https://docs.pingidentity.com/pingds/8.1/configref/objects-http-oauth2-authorization-mechanism.html llms_txt: https://docs.pingidentity.com/pingds/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: parent: Parent dependencies: Dependencies http_oauth2_authorization_mechanism_properties: HTTP OAuth2 Authorization Mechanism properties basic_properties: Basic properties access-token-cache-enabled: access-token-cache-enabled access-token-cache-maxtokens: access-token-cache-maxtokens authzid-template: authzid-template client-id: client-id client-secret: client-secret enabled: enabled identity-mapper: identity-mapper key-manager-provider: key-manager-provider required-scope: required-scope ssl-cert-nickname: ssl-cert-nickname ssl-cipher-suite: ssl-cipher-suite ssl-protocol: ssl-protocol token-introspection-url: token-introspection-url trust-manager-provider: trust-manager-provider advanced_properties: Advanced properties java-class: java-class --- # HTTP OAuth2 Authorization Mechanism The HTTP OAuth2 Authorization Mechanism is used to define OAuth2 authorization using an introspection (RFC7662) compliant authorization server. ## Parent The HTTP OAuth2 Authorization Mechanism object inherits from [HTTP Authorization Mechanism](objects-http-authorization-mechanism.html). ## Dependencies HTTP OAuth2 Authorization Mechanisms depend on the following objects: * [Identity Mapper](objects-identity-mapper.html) * [Key Manager Provider](objects-key-manager-provider.html) * [Trust Manager Provider](objects-trust-manager-provider.html) ## HTTP OAuth2 Authorization Mechanism properties You can use configuration expressions to set property values at startup time. For details, see [Property value substitution](expressions.html). | Basic Properties | Advanced Properties | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | | [access-token-cache-enabled](#access-token-cache-enabled) [access-token-cache-maxtokens](#access-token-cache-maxtokens) [authzid-template](#authzid-template) [client-id](#client-id) [client-secret](#client-secret) [enabled](#enabled) [identity-mapper](#identity-mapper) [key-manager-provider](#key-manager-provider) [required-scope](#required-scope) [ssl-cert-nickname](#ssl-cert-nickname) [ssl-cipher-suite](#ssl-cipher-suite) [ssl-protocol](#ssl-protocol) [token-introspection-url](#token-introspection-url) [trust-manager-provider](#trust-manager-provider) | [java-class](#java-class) | ### Basic properties Use the `--advanced` option to access advanced properties. ### access-token-cache-enabled | | | | ----------------------- | ----------------------------------------------------------------------------- | | *Synopsis* | Indicates whether the HTTP OAuth2 Authorization Mechanism is enabled for use. | | *Default value* | false | | *Allowed values* | truefalse | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### access-token-cache-maxtokens | | | | ----------------------- | -------------------------------- | | *Synopsis* | Maximum size of the token cache. | | *Default value* | 1000 | | *Allowed values* | An integer.Lower limit: 1. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### authzid-template | | | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the Authorization ID as a template. Template keys are JSON pointers into the resolved access token. The template must start with either "u:" or "dn:". Using "u:" will require an identity-mapper to be configured as well. Some examples might be "u:{username}", "dn:uid={username},ou=people,dc=example,dc=com", or "dn:{userdn}". | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### client-id | | | | ----------------------- | ----------------------------------------------------------------------------------------- | | *Synopsis* | Client's ID to use during the HTTP basic authentication against the authorization server. | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### client-secret | | | | ----------------------- | --------------------------------------------------------------------------------------------- | | *Synopsis* | Client's secret to use during the HTTP basic authentication against the authorization server. | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### enabled | | | | ----------------------- | -------------------------------------------------------------- | | *Synopsis* | Indicates whether the HTTP Authorization Mechanism is enabled. | | *Default value* | None | | *Allowed values* | truefalse | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### identity-mapper | | | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the name of the identity mapper(s) to use in conjunction with the authzid-template to get the user corresponding to the access-token. | | *Default value* | None | | *Allowed values* | The name of an existing [identity-mapper](objects-identity-mapper.html).The referenced identity mapper(s) must be enabled when the HTTP OAuth2 Authorization Mechanism is enabled. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### key-manager-provider | | | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the name of the key manager that should be used with this HTTP OAuth2 Authorization Mechanism. | | *Default value* | None | | *Allowed values* | The name of an existing [key-manager-provider](objects-key-manager-provider.html).The referenced key manager provider must be enabled. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | NoneChanges to this property take effect immediately, but only for subsequent requests to the authorization server. | | *Advanced* | No | | *Read-only* | No | ### required-scope | | | | ----------------------- | ----------------------------------------------- | | *Synopsis* | Scopes required to grant access to the service. | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### ssl-cert-nickname | | | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the nicknames (also called the aliases) of the keys or key pairs that the HTTP OAuth2 Authorization Mechanism should use when performing SSL communication. | | *Description* | The property can be used multiple times (referencing different nicknames) when server certificates with different public key algorithms are used in parallel (for example, RSA, DSA, and ECC-based algorithms). When a nickname refers to an asymmetric (public/private) key pair, the nickname for the public key certificate and associated private key entry must match exactly. A single nickname is used to retrieve both the public key and the private key. This is only applicable when the HTTP OAuth2 Authorization Mechanism is configured to use SSL. | | *Default value* | Let the server decide. | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | The object must be disabled and re-enabled for changes to take effect. | | *Advanced* | No | | *Read-only* | No | ### ssl-cipher-suite | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the names of the SSL cipher suites that are allowed for use in SSL or TLS communication. | | *Default value* | Uses the default set of SSL cipher suites provided by the server's JVM. | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | NoneChanges to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. | | *Advanced* | No | | *Read-only* | No | ### ssl-protocol | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the names of the SSL protocols that are allowed for use in SSL or TLS communication. | | *Default value* | Uses the default set of SSL protocols provided by the server's JVM. | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | NoneChanges to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. | | *Advanced* | No | | *Read-only* | No | ### token-introspection-url | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Defines the token introspection endpoint URL where the access-token resolution request should be sent. (example: ) | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### trust-manager-provider | | | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the name of the trust manager that should be used when negotiating SSL connections with the remote authorization server. | | *Default value* | By default, no trust manager is specified indicating that only certificates signed by the authorities associated with this JVM will be accepted. | | *Allowed values* | The name of an existing [trust-manager-provider](objects-trust-manager-provider.html).The referenced trust manager provider must be enabled when SSL is enabled. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | NoneChanges to this property take effect immediately, but only impact subsequent SSL connection negotiations. | | *Advanced* | No | | *Read-only* | No | ## Advanced properties Use the `--advanced` option to access advanced properties. ### java-class | | | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Specifies the fully-qualified name of the Java class that provides the HTTP OAuth2 Authorization Mechanism implementation. | | *Default value* | org.opends.server.protocols.http.authz.HttpOAuth2AuthorizationMechanism | | *Allowed values* | A Java class that extends or implements:- org.opends.server.protocols.http.authz.HttpAuthorizationMechanism | | *Multi-valued* | No | | *Required* | Yes | | *Admin action required* | None | | *Advanced* | Yes | | *Read-only* | No |