立即与支持人员聊天
与支持团队交流

Identity Manager 8.2.1 - Authorization and Authentication Guide

About this guide One Identity Manager application roles Granting One Identity Manager schema permissions through permissions groups Managing permissions to program features One Identity Manager authentication modules OAuth 2.0/OpenID Connect authentication Multi-factor authentication in One Identity Manager Granular permissions for the SQL Server and database Installing One Identity Redistributable STS Program functions for starting the One Identity Manager tools Minimum access levels of One Identity Manager tools

Setting up OAuth 2.0/OpenID Connect authentication for accessing the application server's REST API

The One Identity Manager REST API is an integral part of the application server. To use OAuth 2.0/OpenID Connect authentication for accessing the application server's REST API, there is support for the OAuth2.0/OpenID Connect and OAuth2.0/OpenID Connect (role-based) authentication modules.

Authentication is done using the access token provided. The first time a request is made with a new access token, a session is established with that token and the authentication module. Further accesses with the same token use the same session. The validity period of the token is checked in the process.

For more information about the One Identity Manager REST API, see One Identity Manager REST API Reference Guide.

Related topics

Setting up OAuth 2.0/OpenID Connect authentication for accessing the REST API

NOTE: To access the REST API in the application server, users need the Allow access to the application server's REST API (AppServer_API) function.

To set up authentication for the REST API using OAuth 2.0/OpenID Connect

  • In the Designer, set the QBM | AppServer | AccessTokenAuth configuration parameter.

  • In the Designer, set the respective authentication module either OAuth 2.0/OpenID Connect or OAuth 2.0/OpenID Connect (role-based).

  • If the OAuth 2.0/OpenID Connect (role-based) authentication module is used, set the QBM | AppServer | AccessTokenAuth | RoleBased confguration parameter as well.

  • In the Designer, create the OAuth 2.0/OpenID Connect configuration and assign the configuration to the web application for the application server.

  • The URL for the application server must be declared.

    When the application server is installed, an entry for the web application is created with the URL in the QBMWebApplication table. Check whether the URL (BaseURL column) is entered.

ClosedDisplay settings for web applications
Related topics

Authentication module for using OAuth 2.0/OpenID Connect for authentication access to the REST API

An authentication module is provided within the application server to authenticate using access tokens. The application server client uses the information from the authentication module to determine the access token for logging in on the server side.

For example, the authentication module can be used for Job servers that do not have a direct connection to the database but work against an application server.

To use the authentication module, ensure that authentication for accessing the REST API is set up using OAuth 2.0/OpenID Connect.

NOTE: If authentication is by access token, other authentication modules are excluded from use and the application server returns an error.

Authentication data for establishing a connection through the application server's REST API.

Module=Token;Url=<URL of the application server>;ClientId=<client-ID>;ClientSecret=<secret>;TokenEndpoint=<token endpoint>.

With the following parameters:

  • URL: URL of the application server

  • ClientId: Client ID for authentication at the token endpoint.

  • ClientSecret: Secret value for authentication at the token endpoint.

  • TokenEndpoint: URL of the token endpoint.

For more information about providing connection and authentication data to the application server for Job servers, see the One Identity Manager Configuration Guide.

Related topics

Authenticating external applications using OAuth 2.0/OpenID Connect

To access the REST API in the application server through external applications, authentication is supported by the OAuth2.0/OpenID Connect and OAuth2.0/OpenID Connect (role-based) authentication modules. Ensure that REST API authentication is set up through OAuth 2.0/OpenID Connect.

To authenticate an external application using Oauth 2.0/Openid Connect in One Identity Manager

  1. Log in to the external identity provider, for example with Redistributable STS (RSTS), and get the access token.

  2. Ensure that the token is passed as the bearer token in the authentication header of all queries.

NOTE: The session must be handled by a bearer token when logging in using a session cookie. Clients accessing the REST API using the bearer token must therefore keep the cookie assigned during the first access and send it with subsequent accesses. Otherwise, a new session is established for each access, which costs a lot of resources.

Related topics
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级