Configuring OAuth authorization servers - PingAccess - 7.2

PingAccess

bundle
pingaccess-72
ft:publication_title
PingAccess
Product_Version_ce
PingAccess 7.2
category
Product
pa-72
pingaccess
ContentType_ce

Configure, modify, and edit the OAuthOAuth A standard framework that enables an application (OAuth client) to obtain access tokens from an OAuth authorization server for the purpose of retrieving protected resources on a resource server. authorization servers in PingAccess.

If you plan to use Mutual TLS, modify the token provider to provide the mtls_endpoint_aliases object, with content defined by RFC-8705, on the OpenID Connect (OIDC)OpenID Connect (OIDC)OIDC An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management. well-known configuration endpointendpoint One end in a communication channel, typically a URI..

  1. Click Settings and then go to System > Token Provider > Common > OAuth Authorization Server.
  2. Optional: In the Description field, enter a description for the authorization server.
  3. In the Targets field, enter one or more hostname:port pairs for the OAuth authorization server. Click + Add Target to add additional targets.
  4. In the Introspection Endpoints field, specify the OAuth endpoint through which the token introspection operation is accomplished.
  5. In the Token Endpoint field, enter the OAuth 2.0 Authorization Server’s token endpoint.
  6. Select the Audit check box to record requests to the OAuth authorization server to the audit store.
  7. Select the Secure option if the OAuth authorization server is expecting HTTPS connections.
  8. From the Trusted Certificate Group list, select the group of certificates to use when authenticating to the OAuth authorization server.

    PingAccess requires that the certificate in use by OAuth authorization server anchors to a certificate in the associated trusted certificate group.

  9. In the Client ID field, enter the unique identifier assigned when you created the PingAccess OAuth client within your OAuth authorization server.
  10. Select a Client Credentials Type, then provide the information required for the selected credential type.
    • Secret – Enter the Client Secret assigned when you created the PingAccess OAuth client in the token provider.
    • Mutual TLS – Select a configured Key Pair to use for mutual TLS client authentication.
    • Private Key JWT – Select this option to use Private Key JSON web token (JWT). No additional information is required.
  11. Optional: Select the Cache Tokens option to retain token details for subsequent requests.

    This option reduces the communication between PingAccess and OAuth authorization server.

  12. Optional: Select the Token Time To Live check box to enter the number of seconds to cache the access token.

    A value of -1 means there is no limit. This value should be less than the OAuth authorization server token lifetime.

  13. In the Subject Attribute Name field, enter the attribute you want to use from the OAuth access token as the subject for auditing purposes.

    At runtime, the attribute's value is used as the Subject field in audit log entries for APIapplication programming interface (API) A specification of interactions available for building software to access an application or service. Resources with policies that validate access tokens.

  14. Select the Send Audience check box to send the URI the user requested as the aud OAuth parameter for PingAccess to the OAuth 2.0 authorization server.
  15. To configure advanced settings, click Show Advanced.
    1. To use a configured proxy, select the Use Proxy check box.
  16. Click Save.
    Note:

    If the node is not configured with a proxy, requests are made directly to the token provider.