{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"6"},"outline":{"value":"false"},"style":{"value":"default"},"type":{"value":"list"},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"c34b596b-83e5-4d57-b8ac-57f2facfd445"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"1e2024e9-7352-435d-b322-9bc507ae2670"}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this policy to authenticate a client by delegating the authentication to an OAuth2 provider. If this policy is applied, it is used to authenticate any request that does not contain credentials for any other authentication policies (such as API Key). The client is redirected to the OAuth provider to start the authentication flow. Once the flow completes, and the access token is obtained, the policy uses it to perform one or more requests to get information about the user, such as the ID and assigned role. Finally, a session cookie is returned to the client, and the client is redirected back to the requested URL. Subsequent requests authenticate based on the session cookie instead of repeating the OAuth flow. This implementation is based on the ","type":"text"},{"text":"authorization code flow from Okta","type":"text","marks":[{"type":"link","attrs":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/#authorization-code-flow"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Starting in the October 2023 release, SnapLogic supports the implementation of OpenID. You can now use your OpenID Connect provider for the authentication controls in your Genric OAuth2 API policy. ","type":"text"}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The Generic OAuth2 API Policy also supports OAuth 1.0.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Policy Requirements","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"All Authentication policies require the Authorize By Role policy to authenticate the API caller correctly","type":"text"},{"text":". For example, you can configure this policy to add the role ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"“admin”","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"em"}]},{"text":" to the client and then configure the Authorize By Role policy to authorize users with that role.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Users must enable cookies in their browser for this policy to work with OAuth providers.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verified Providers","type":"text"}]},{"type":"paragraph","content":[{"text":"SnapLogic verified the following authentication providers for this policy:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Okta","type":"text","marks":[{"type":"link","attrs":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"GitHub","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Salesforce","type":"text","marks":[{"type":"link","attrs":{"href":"https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ping Identity","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.pingidentity.com/en/resources/content-library/articles/oauth.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Azure","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"}}]}]}]}]},{"type":"paragraph","content":[{"text":"This policy might work with other authentication providers not listed above but has not been tested and verified.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"OAuth 2.0 Framework for Authorization Code Grant Type","type":"text"}]},{"type":"paragraph","content":[{"text":"The OAuth 2.0 Authorization Code grant flow is a way for an the client to request an authorization code from an authorization server with the involvement of a user. This flow is suitable for scenarios where the client application needs to access resources on behalf of a user.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The OAuth 2.0 Authorization Code flow enables a client application to access other services securely. This is done by authenticating the user's credentials without directly exposing the user's password to the client application. As the resource owner only authenticates with the authorization server, the resource owner's credentials are never shared with the client.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The client application requests an authorization code from the authorization server, which the user approves. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The client then exchanges the authorization code for an access token, which is used to access protected resources on the user's behalf.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"OAuth Roles","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client","type":"text","marks":[{"type":"strong"}]},{"text":": The client is an application that requests access to resources on another resource server. The client redirects the user to the authorization server for authentication and authorization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Resource Owner (User)","type":"text","marks":[{"type":"strong"}]},{"text":": The user who owns the resources to which the client application is requesting access.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authorization Server","type":"text","marks":[{"type":"strong"}]},{"text":": The authorization server authenticates the user's identity and issues authorization codes and access tokens to the application once authorization is granted.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Mapping Out the Protocol Flow","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":900,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":442,"alt":"Protocol-flow-GenericOAuth.png","id":"3f81cac7-fd26-4fd9-89d5-454cb8e71cc5","collection":"contentId-1246924052","type":"file","height":265},"marks":[{"type":"border","attrs":{"size":1,"color":"#172b4d"}}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Authorization Code Grant Flow","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client Registration","type":"text","marks":[{"type":"strong"}]},{"text":": The application is registered with the Identity Provider such as Ping Identity, Okta, Github, Salesforce or Azure which issues a Client ID, Client Secret and Redirect URI. These credentials are used to authenticate the application to the Identity Provider.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Policy Configuration","type":"text","marks":[{"type":"strong"}]},{"text":": Field settings of the policy for the API endpoint includes:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OpenID Discovery Document URL","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login URL","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"JWS Algorithm","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Scopes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access Token URL","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client ID and Client Secret","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Redirect URI","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authorization Request","type":"text","marks":[{"type":"strong"}]},{"text":": When the application needs to access resources on behalf of a user, it redirects the user to the Identity Provider's authorization endpoint, including its client ID and client secret where the authorization server sends the authorization code.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User Authentication and Authorization","type":"text","marks":[{"type":"strong"}]},{"text":": The user authenticates with the Identity Provider and grants permission to the application to access their resources. If the user approves, the Identity Provider redirects the user back to the client application with an authorization code.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Token Request","type":"text","marks":[{"type":"strong"}]},{"text":": The client application receives the authorization code and sends a request to the Identity Provider's token endpoint to exchange the authorization code for an access token.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Token Issuance","type":"text","marks":[{"type":"strong"}]},{"text":": The Identity Provider validates the authorization code and the client's credentials. If valid, the Identity Provider issues an access token to the client application.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Resource Access","type":"text","marks":[{"type":"strong"}]},{"text":": The client application uses the access token to access protected resources on behalf of the user. The access token is included in the authorization header of the HTTP request.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Policy Execution Order","type":"text"}]},{"type":"paragraph","content":[{"text":"The Generic OAuth2 policy executes after the other authentication policies, specifically those whose mechanisms are based on the client providing a token in the request, like the API Key or Callout Authenticator policies.","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"multiexcerpt-include-macro","parameters":{"macroParams":{"name":{"value":"Expression Enabled Fields"},"page":{"value":"Anonymous Authenticator"}},"macroMetadata":{"macroId":{"value":"578c002a-a665-4805-b8e7-57f417f1bb2d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://raw.githubusercontent.com/fuegokit/appfire-design-systems-brand-svg/main/single-color-brand-icons/af-logo-multi-excerpt-24.svg"}}],"title":"MultiExcerpt Include"}},"localId":"5f05cf6e-6737-4dea-ac66-ec3a5305d33e"}}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Settings","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1775.0,"localId":"d86435fc-729f-42e0-8af7-14638d5dee4a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Default Value","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Label","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The name for the API policy.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Generic OAuth2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"GitHub OAuth 2.0 Policy","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"When this policy should be applied","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"An expression enabled field that determines the condition to be fulfilled for the API policy to execute.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, if the value in this field is ","type":"text"},{"text":"request.method == \"POST\"","type":"text","marks":[{"type":"em"}]},{"text":", the API policy is executed only if the request method is a POST.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"request.method == “POST”","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Use OpenID Connect","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Select to use an OpenID Connect (OIDC) vendor as the 3rd-party IdP.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Deselected","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"Selected","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"OpenID Discovery Document URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The OIDC discovery URL.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":3,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Login URL*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The login URL for the client.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"JWS Algorithm*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The algorithm used to generate the JSON Web Service token. You can find this in the Discovery Document URL to determine which algorithm is supported: ","type":"text"},{"text":"id_token_signing_alg_values_supported","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"Select one of the following algorithm types:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HS256","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HS384","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HS512","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RS256","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RS384","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RS512","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"RS256","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Required Scopes","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The list of OAuth2 scopes required to get information about a user. See ","type":"text"},{"text":"OAuth 2.0 Scopes","type":"text","marks":[{"type":"link","attrs":{"href":"https://oauth.net/2/scope/"}}]},{"text":" for details. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"type":"emoji","attrs":{"id":"2a9fa59e-409c-48ef-b17f-c9a70e48ebcd","text":":Add_Icon:","shortName":":Add_Icon:"}},{"text":" to add scopes.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Scope","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The name of the OAuth2 scope. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"user","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"token","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"session","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Access Token URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The OAuth2 provider’s access token URL. The response from this token URL will be stored in $token and can be referenced in ","type":"text"},{"text":"User Info URL ","type":"text","marks":[{"type":"strong"}]},{"text":"below.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"https://github.com/login/oauth/access_token","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://github.com/login/oauth/access_token"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Client ID","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The ID of the application registered with the OAuth2 provider.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"jdoe@beignet.com","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"mailto:jdoe@beignet.com"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Client Secret","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The client secret for the application registered with the OAuth2 provider.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"chocolatE","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Redirect URI","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The URI of the Snaplex load-balancer appended with ","type":"text"},{"text":"/api/1/rest/oauth2/callback","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"https://groundplex.example.com/api/1/rest/oauth2/callback","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://groundplex.example.com/api/1/rest/oauth2/callback"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"User Info URL #1-2","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"These sections describe the HTTP GET requests this API policy should make to get information about a user.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Limitation","type":"text","marks":[{"type":"strong"}]},{"text":": The ","type":"text"},{"text":"User Info URL","type":"text","marks":[{"type":"strong"}]},{"text":" field and settings do not support expressions that use the ","type":"text"},{"text":"asset","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"request","type":"text","marks":[{"type":"code"}]},{"text":" variables.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"User Info URL #2 is optional.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Trust all certificates","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Trust all certificates","type":"text","marks":[{"type":"code"}]},{"text":" for expired or self-assigned certificates.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Enabling this option bypasses the certificate validation process. The request will successfully proceed if the upstream URL provides an invalid certificate (expired or self-assigned) during the SSL handshake.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"False/Not selected","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Target Path","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The location to store the result of the request in the working object as a JSON-Path.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"If you leave this field blank, the URL is not called.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"$user","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The destination for the request.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"https://idp.example.com/user","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://idp.example.com/user"}}]}]},{"type":"paragraph","content":[{"text":"https://api.github.com/user","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://api.github.com/user"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Query Parameters","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The query parameters (name and value) to add into the URL.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Headers","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"The headers (name and value) to include in the request.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"Authorization","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Extract User Info","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". Specifies how to extract information about the user from the working object.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"User ID Expression","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". An expression that returns a string to be used as the user ID.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":" $user.email","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Roles Expression","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". An expression that returns the list of roles this user is in.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"$user.groups.map(group => ","type":"text","marks":[{"type":"em"}]},{"text":"group.name","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"http://group.name"}}]},{"text":")","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Session: Time-To-Live in Seconds","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The number of seconds for which the session is active. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"86400","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"90000","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"OAuth State: Time-To-Live in Seconds","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"em"}]},{"text":". The number of seconds for which the Oauth state is active. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"300","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"1000","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[280.0]},"content":[{"type":"paragraph","content":[{"text":"Status","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[993.0]},"content":[{"type":"paragraph","content":[{"text":"Specifies whether the API policy is enabled or disabled. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[318.0]},"content":[{"type":"paragraph","content":[{"text":"Disabled","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Examples of Configuring the Generic OAuth2 API Policy with OIDC Providers","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Google IdP Application Field Mappings","type":"text"}]},{"type":"paragraph","content":[{"text":"You can use Google Cloud Services to set up Google as an IdP for your OAuth2.0 policy. Refer to ","type":"text"},{"text":"Google Cloud documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloud.google.com/docs"}}]},{"text":" for the account information required to fill out the Generic Oauth2 policy form. ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A project, with credentials ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OAuth client ID.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Workflow","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the OAuth Consent Screen under APIs and Services.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When you create ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an Application, choose an Application Type, and give it a name.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add your redirect URL under Authorize redirect URIs. ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The following table provides the mapping between the Google IdP application endpoints and the Generic OAuth2 policy OpenID field values.","type":"text"}]},{"type":"paragraph","content":[{"text":"Refer to ","type":"text"},{"text":"Google Cloud documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloud.google.com/docs"}}]},{"text":" for the account information required to fill out the Generic Oauth2 policy form. ","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"7e555b1e-c554-4ae5-9d97-9452ed4da863"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Generic Oauth Policy","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"Google Open ID Connect","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"Example Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"OpenID Discovery Document URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"\"authorization_endpoint\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"\"https://accounts.google.com/.well-known/openid-configuration\"","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Login URL*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"\"openid-configuration \"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"\"https://accounts.google.com/o/oauth2/v2/auth\"","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"JWS Algorithm*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"RS256","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Scopes","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"\"openid\"","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"\"email\"","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"\"profile\"","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Access Token URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"\"token_endpoint\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"\"https://oauth2.googleapis.com/token\"","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":1},"content":[{"text":"Azure IdP Application Field Mappings","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Microsoft Entra ID","type":"text"}]},{"type":"paragraph","content":[{"text":"You can use Microsoft Entra ID as an IdP for your OAuth2.0 policy.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A project, with credentials ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OAuth client ID.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Workflow","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the OAuth Consent Screen under APIs and Services.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When you create ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an Application, choose an Application Type, and give it a name.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add your redirect URL under Authorize redirect URIs. ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The following table provides the mapping between the Microsoft Entra ID application endpoints and the Generic OAuth2 policy OpenID field values, where the application name is ","type":"text"},{"text":"2ada741a-1b5a-49e4-c3bd-fc2a72b698c","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"26a85106-1d93-4676-96c0-d95fa530f0cc"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"Generic Oauth Policy OpenID Fields","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Microsoft Entra ID Connect","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"Example Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"OpenID Discovery Document URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Microsoft Entra ID application endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"https://login.microsoftonline.com/2ada741a-1b5a-49e4-c3bd-fc2a72b698c/v2.0/.well-known/openid-configuration","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"Login URL*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Microsoft Entra ID authorization endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"https://login.microsoftonline.com/2ada741a-1b5a-49e4-c3bd-fc2a72b698c/oauth2/v2.0/authorize","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"JWS Algorithm*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"RS256","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"Scopes","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"openid","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"email","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"Access Token URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Microsoft Entra ID token endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[425.0]},"content":[{"type":"paragraph","content":[{"text":"\"https://login.microsoftonline.com/2ada741a-1b5a-49e4-c3bd-fc2a72b698c/oauth2/v2.0/token\"","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"AD B2C Application","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A tenant","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An active subscription","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Workflow","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Have an active subscription.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a B2C tenant.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Register an app for support type for Accounts in any identity provider or organizational directory (for authenticating users with user flows)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Register another support type for Accounts in this organizational directory only (TestingB2CAPIM only - Single tenant)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a user flow. The user flow functions like a policy.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use your app (for authenticating users with user flows) to get URL endpoints to set up your policy","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add an Identity Provider to your B2C tenant using your single-tenant app","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add your redirect URI to your single-tenant app ","type":"text"},{"text":"https://yourtenantname.youruserflowname.com/yourtenantname.onmicrosoft.com/oauth2/authresp","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add your redirect URI, which you provided in the Generic Oauth2 to your app for support type for Accounts in any identity provider or organizational directory (for authenticating users with user flows)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The following table provides the mapping between the Azure AD B2C application endpoints and the Generic OAuth2 policy OpenID field values, where the name of the user workflow","type":"text"},{"text":" (policy-name)","type":"text","marks":[{"type":"code"}]},{"text":" is ","type":"text"},{"text":"the app name you create for user flows","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"0ef71446-351b-4d87-ab34-971d6ee82487"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"Generic Oauth Policy OpenID Fields","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"AD B2C Connect","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"OpenID Discovery Document URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"Azure AD B2C 2.0 Open ID Connect metadata document","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"https://example-app.b2clogin.com/example-app.onmicrosoft.com/B2C_1_sign/v2.0/.well-known/openid-configuration","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"Login URL*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"Azure AD B2C 2.0 authorization endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"https://example-app.b2clogin.com/example-app.onmicrosoft.com/B2C_1_sign/oauth2/v2.0/authorize","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"JWS Algorithm*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"RS256","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"Scopes","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"openid","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"Access Token URL","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[202.0]},"content":[{"type":"paragraph","content":[{"text":"Azure AD B2C 2.0 token endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"\"https://example-app.b2clogin.com/example-app.onmicrosoft.com/B2C_1_sign/oauth2/v2.0/token\"","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"For single tenant uses, you should create a redirect URI, which is the application URL.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Session Management","type":"text"}]},{"type":"paragraph","content":[{"text":"The OAuth2.0 API Policy might require consideration for active session management from an administrative point of view. A network issue or company policy might necessitate overriding the ","type":"text"},{"text":"Time-to-Live","type":"text","marks":[{"type":"strong"}]},{"text":" settings. For this purpose, the following APIs allow a SnapLogic Org admin the ability to list session details and delete sessions as needed:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","width":1800.0,"localId":"d1a89a95-87c6-4bb2-9238-39e4a8e5125d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[241.0]},"content":[{"type":"paragraph","content":[{"text":"Purpose","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[719.0]},"content":[{"type":"paragraph","content":[{"text":"API Call","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[241.0]},"content":[{"type":"paragraph","content":[{"text":"List all sessions","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[719.0]},"content":[{"type":"paragraph","content":[{"text":"GET <","type":"text"},{"text":"Load_Balancer","type":"text","marks":[{"type":"code"}]},{"text":">/<","type":"text"},{"text":"JCC_Host","type":"text","marks":[{"type":"code"}]},{"text":">/api/1/rest/policy/session","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[241.0]},"content":[{"type":"paragraph","content":[{"text":"List a specific session","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[719.0]},"content":[{"type":"paragraph","content":[{"text":"GET <","type":"text"},{"text":"Load_Balancer","type":"text","marks":[{"type":"code"}]},{"text":">/<","type":"text"},{"text":"JCC_Host","type":"text","marks":[{"type":"code"}]},{"text":">/api/1/rest/policy/session/<","type":"text"},{"text":"Session_Id","type":"text","marks":[{"type":"code"}]},{"text":">","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[241.0]},"content":[{"type":"paragraph","content":[{"text":"Delete a specific session","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[719.0]},"content":[{"type":"paragraph","content":[{"text":"DEL <","type":"text"},{"text":"Load_Balancer","type":"text","marks":[{"type":"code"}]},{"text":">/<","type":"text"},{"text":"JCC_Host","type":"text","marks":[{"type":"code"}]},{"text":">/api/1/rest/policy/session/<","type":"text"},{"text":"Session_Id","type":"text","marks":[{"type":"code"}]},{"text":">","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[241.0]},"content":[{"type":"paragraph","content":[{"text":"Delete all sessions","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[719.0]},"content":[{"type":"paragraph","content":[{"text":"DEL <","type":"text"},{"text":"Load_Balancer","type":"text","marks":[{"type":"code"}]},{"text":">/<","type":"text"},{"text":"JCC_Host","type":"text","marks":[{"type":"code"}]},{"text":">/api/1/rest/policy/session","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"These APIs do not apply to the ","type":"text"},{"text":"Time-To-Live","type":"text","marks":[{"type":"strong"}]},{"text":" settings in the Callout Authenticator API policy. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The session management details returned includes the ","type":"text"},{"text":"session ID","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"user","type":"text","marks":[{"type":"strong"}]},{"text":" or ","type":"text"},{"text":"client","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"details","type":"text","marks":[{"type":"strong"}]},{"text":" upon making the API call. Below is the sample response upon using the GET HTTP method:","type":"text"}]},{"type":"codeBlock","content":[{"text":"[\n {\n \"type\": \"TaskSession$OauthSession\",\n \"username\": \"105450719975802175246\",\n \"roles\": [\n \"openid\",\n \"email\",\n \"profile\"\n ],\n \"session_id\": \"0f9eb160-b5ed-4cba-94ea-b5a3ae1fc9e0\",\n \"expires_at\": 1718323653745\n },\n {\n \"type\": \"TaskSession$OauthSession\",\n \"username\": \"105450719975802175246\",\n \"roles\": [\n \"openid\",\n \"email\",\n \"profile\"\n ],\n \"session_id\": \"79258c26-e361-46c5-9588-5301434a738a\",\n \"expires_at\": 1718323838403\n }\n]","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If no session is created and an API for the session ID is called, the response returned contains an empty list.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A session ID that’s been previously deleted will return a ","type":"text"},{"text":"404 status code","type":"text","marks":[{"type":"code"}]},{"text":" upon using GET request.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Related Content","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SnapLogic API Management","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs-snaplogic.atlassian.net/wiki/spaces/SD/pages/1402142725"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Managing your Developer Portal Settings","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs-snaplogic.atlassian.net/wiki/spaces/SD/pages/2215018531/Managing+your+Developer+Portal+Settings"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Policy Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs-snaplogic.atlassian.net/wiki/spaces/SD/pages/1068859547"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Insights","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs-snaplogic.atlassian.net/wiki/spaces/SD/pages/1201504326"}}]}]}]}]}],"version":1}