OAuth Server

OAuth server endpoint configuration for local OAuth 2.0 Servers that represent the server sides of the OAuth communications. The DirX Access OAuth Server is not accessed directly; it requires at least one OAuth Provider FEP. Each OAuth Server’s metadata is automatically generated from the current configuration and can also be accessed through the OAuth Provider FEP at:

  • issuer-url-identification/.well-known/openid-configuration Where issuer-url-identification is the URL of the OAuth Server supplied in the "Issuer" field of the Servers page.

Description

Description of the configuration object

Issuer

The URL identification of the OAuth Server. The value indicates the issuer of authorization codes and tokens and is placed into metadata. When there is no load balancer, the Issuer field should be the same as the OAuth Provider FEP location field. (The simple scenario with one OAuth Provider FEP and one OAuth Server.) When a there is a load balancer in front of multiple OAuth Provider FEPs that point to one OAuth Server, the Issuer field should be the same as the location of the load balancer. If no issuer value is set, the default value 'unknown' is used.

Associated Web PEP identifier

The identifier of the Web PEP that enforces the security policy at the endpoint. If not set, default value 'unknown' is used, but the server will not be able to process requests.

Client metadata identifiers

The metadata of statically-registered remote OAuth clients. Unregistered OAuth clients cannot access the OAuth Server.

Do HTTP redirect URI support

Whether or not unsecure HTTP redirect URIs in client metadata are supported.

Do invalid client metadata support

Whether or not the OAuth Authorization server tries to process requests from clients referenced by invalid client metadata.

Cache validation interval

The frequency with which the validity of issued authorization codes and tokens is checked in seconds.

Crypto container identifiers

The references on crypto containers used for cryptography purposes.

OAuth registration endpoint

Current OAuth registration point.

Rule template registration endpoint

Current OAuth rule template registration point. Value that informs the administrator about the exact location of the rule template registration endpoint.

OAuth server authorization token endpoint

The collection of fields and controls to configure the authorization and token endpoint that issues the authorization codes and tokens. The order of the items is important.

Grant types

The permitted grant types to which authorization codes / token issuance is restricted. Supported grant types are implicit, refresh_token, password, client_credentials, authorization_code and urn:ietf:params:oauth:grant-type:uma-ticket.

Scopes

The permitted scopes to which authorization codes/token issuance is restricted.

Authorization code validity

The validity period for the issued authorization codes in seconds.

Access token validity

The validity period for the issued access tokens in seconds.

Access token representation

The representation of the access token. Possible values are:

  • Random: the access token is represented by the random string. Default option.

  • JWT: the access token is represented by the JSON Web Token.

  • Allowed Values:

    • Random

    • JWT

Do issue Refresh token

Whether or not a refresh token is issued together with an access token.

Do revoke used Refresh token

Whether or not to revoke a refresh token that has been used.

Refresh token validity

The validity period for issued refresh tokens in seconds.

Password Grant Authentication method identifier

The password authentication method reference to be used for password grant types.

OAuth Client Authentication method identifier

The OAuth client authentication method reference used to resolve the subject of an incoming id_token during token exchange.

OAuth Resource Server Authentication method identifier

The OAuth authentication method reference used to resolve the subject of an incoming access_token during token exchange.

Persisted claims token validity

The validity period for issued persisted claims tokens in seconds.

Attribute Template identifiers

The key and value pairs to be imprinted as custom claims in a JSON Web Token (e.g. OpenID Connect ID token) in any scenario in which a token is created (including Token Exchange profile).

JWS key identification parameter (ID Token)

The identification of the JSON Web Signature key. Possible values are:

  • None: JWS key identification is not present in JWS header of ID Token as JSON Web Token. Default option.

  • x5c: JWS key is represented by the certification chain.

  • Allowed Values:

    • None

    • x5c

Do ACE support (experimental)

Whether or not to support OAuth ACE specification.

Do PKCE for OAuth 2.0 support

Whether or not to support Proof Key for Code Exchange (PKCE) for OAuth 2.0 specification. Note that the 'Public client support for token endpoint' checkbox must be checked.

Do support Resource Indicators

Whether or not to support Resource Indicators for OAuth 2.0 specification.

Do support JWT format for access token

Whether or not to use the JWT format for the OAuth 2.0 access token according to the RFC#9068.

Do public client support for token endpoint

Whether to support token refresh for public clients and code flow for OAuth 2.0 specification.

Do print user consent

Whether or not ask user to grant his consent to requested properties by client application.

Signing applicability

This parameter has the following consequences:

  • REQUIRED the JWT will always be signed, if an appropriate signing key not available, an error will be thrown,

  • PREFERRED the JWT will be signed if there is an appropriate signing key,

  • NONE the JWT will not be signed.

  • Allowed Values:

    • NONE

    • PREFERRED

    • REQUIRED

Encryption applicability

This parameter has the following consequences:

  • REQUIRED the JWT will always be encrypted, if an appropriate encryption key not available, an error will be thrown,

  • PREFERRED the JWT will be encrypted if there is an appropriate encryption key,

  • NONE the JWT will not be encrypted.

  • Allowed Values:

    • NONE

    • PREFERRED

    • REQUIRED

JWS key identification parameters (Access Token)

The identification of the JSON Web Signature key. If empty, JWS key identification is not present in JWS header of Access token. Possible values are:

  • x5t: JWS key is represented by the certification thumbprint. Default option.

  • x5c: JWS key is represented by the certification chain.

  • kid: JWS key is represented by the key ID.

Subject token type

The subject_token_type values this profile applies to. An empty collection matches any subject token type.

Actor token type

The actor_token_type values this profile applies to. An empty collection matches any actor token type.

Requested token type

The requested_token_type values this profile applies to. An empty collection matches any requested token type.

Target audience

The condition on the target audience in Disjunctive Normal Form, for example (A^B) v (C^D)*. A plain conjunction matches only if the actual audiences are exactly its values, whereas an open-ended one, marked by a trailing *, matches whenever they contain its values, further audiences being allowed. A condition left blank matches any target audience, whereas () matches an empty one. In case of configuration without DirX Access Manager, use parenthesized conjunctions separated by commas, for example (A,B,C),(D) and append * to a conjunction for open-ended matching, for example (A,B,C)*.

Requested scope predicates

The condition on the requested scopes in Disjunctive Normal Form, for example (A^B) v (C^D)*. A plain conjunction matches only if the requested scopes are exactly its values, whereas an open-ended one, marked by a trailing *, matches whenever they contain its values, further scopes being allowed. A condition left blank matches any requested scopes, whereas () matches empty ones. In case of configuration without DirX Access Manager, use parenthesized conjunctions separated by commas, for example (A,B,C),(D) and append * to a conjunction for open-ended matching, for example (A,B,C)*.

Claim criteria

Universal claim-based routing criteria, each a (source, claimName, expression) triple. Enables using claims such as iss, client, sourceAud and subjectTokenScopePredicates in configuration routing.

Delegation with actor token allowed

Whether delegation with an actor token is allowed.

Delegation with actor token downgrade to impersonation

Whether to fall back to impersonation mode if delegation conditions are not met. Applied to requests with non-empty actor_token.

Delegation with actor token may act required

Whether the may_act claim must be present (and matching) in the subject token when an actor_token is present.

Delegation without actor token mode

Behavior when no actor_token is present. Values: DELEGATION_CLIENT_AS_ACTOR, IMPERSONATION, DENY.

  • Allowed Values:

    • DELEGATION_CLIENT_AS_ACTOR

    • IMPERSONATION

    • DENY

Delegation without actor token may act required

Whether the may_act claim must be present in the subject token when no actor_token is present.

Multi-audience strategy

Strategy for handling multiple audiences. Values:`INTERSECT_SCOPES` - keep all requested audiences and intersect applicable scopes,FILTER_AUDIENCES - keep maximal set of scopes and remove audiences that would limit them,REQUIRE_UNIFORM - require all audiences and scopes to be preserved after evaluation, if not possible - error.

  • Allowed Values:

    • INTERSECT_SCOPES

    • FILTER_AUDIENCES

    • REQUIRE_UNIFORM

Scope resolution strategy

Strategy for resolving the effective scope after scope evaluation. Values: EXACT - all requested scopes must be present (if not, error), FILTERED - scopes can be filtered and any result is imprinted into a valid token, EMPTY_TO_ERROR - if empty scopes are the result, error.

  • Allowed Values:

    • EXACT

    • FILTERED

    • EMPTY_TO_ERROR

Default requested token type

The default requested_token_type URI when none is specified in the request.

  • Allowed Values:

    • urn:ietf:params:oauth:token-type:access_token

    • urn:ietf:params:oauth:token-type:id_token

    • urn:ietf:params:oauth:token-type:refresh_token

Maximum lifetime

Maximum exchanged-token lifetime in seconds. The exchanged token never lives longer than this value, but it may live shorter if the access token validity of the flow is lower. A value of 0 means unlimited, i.e. no upper bound is imposed and the access token validity of the flow applies.

Cap to source

Whether to cap an exchanged token’s lifetime to the remaining lifetime of the source token.

Audience name mapping

Mapping of logical audience names to audience URI identifiers used in token exchange target audience resolution.

Default target audience

The default target audience identifier used when no audience parameter is specified in the token exchange request.

Trusted issuers for external audience

The trusted issuers whose tokens are accepted when resolving the subject of an incoming token during token exchange targeting an external audience.

Token Exchange PEP

The PEP reference used for authorization decisions during token exchange scope evaluation. If empty, there is no scopes evaluation and any requested scopes are always permitted.

OAuth server protected endpoint

The collection of fields and controls to configure protected endpoints (endpoints that require authentication for access). Most of these endpoints require authentication via a bearer profile with specific scopes. The order of the items is important.

OAuth server URI suffix

The read-only URI suffix of the OAuth Server protected endpoint. The URI suffix is calculated from the type of the OAuth Server protected endpoint.

OAuth server scopes

The allowed scopes to access the OAuth Server protected endpoint.

Protected endpoint type

The type of the OAuth Server protected endpoint.

  • Allowed Values:

    • Token introspection

    • User info

    • Resource registration

    • Token revocation

    • Permission

    • Policy management

    • Rule template registration

    • Claims interaction

    • Dynamic client registration

    • Logout

Bearer Profile Transmission methods

The transmission methods allowed to be used for authentication via the bearer profile. The transmission methods allowed to be used for authentication via the bearer profile. Supported transmission methods are Header field (default), Body parameter and Query parameter.

Attribute template identifiers

The collection of OAuth attribute templates as the key and value pairs to be returned in a JavaScript Object Notation (JSON) object. The control is valid for user info and introspection protected endpoint.

Permission ticket validity

The validity period for issued permission tickets in seconds. The control is valid for permission protected endpoint.

Token types

The token types that are allowed to be revoked. The control is valid for token revocation protected endpoint. Supported token types are access_token, pct and refresh_token.

Do PCT issuance support

Whether or not persisted claims token (PCT) issuance is supported. The control is valid for claims interaction protected endpoint.

Do support open registration

Whether or not any client with a valid registration request can register itself with the authorization server. The control is valid for dynamic client registration protected endpoint.

Client secret validity

The validity period for expiration of client registrations in seconds. The control is valid for dynamic client registration protected endpoint.

Supported scopes

The registering client can be granted only those preregistered scopes. The control is valid for dynamic client registration protected endpoint.

Do support OpenID registration

Whether or not OpenID Connect Dynamic Client Registration extension is supported. The control is valid for dynamic client registration protected endpoint.

Do support public client type

Whether or not public clients are supported for registration. The control is valid for dynamic client registration protected endpoint.

Do support confidential client type

Whether or not confidential clients are supported for registration. The control is valid for dynamic client registration protected endpoint.

Do support token refresh for public clients

Whether to support token refresh for public clients using code flow for OAuth 2.0 specification.

Custom user access policy URI

The value refers to the address of any custom application that provides the policy management API for the resource registration response. The control is valid for resource registration protected endpoint.

Associated Single logout configuration

The identifier of the Single logout configuration that will be used if this protected endpoint is a Logout endpoint.