Authenticating webMethods.io API Gateway APIs using OAuth2.0 using a local authorization server
This article explains about how to implement OAuth 2.0 on API Gateway for local authorization server
It is assumed that readers of this article know how to set up API’s and policies on API Gateway.
• Active tenant subscription on webMethods.io API Gateway
• Configure the API at API gateway.
• Create Application and associate API with the application.
• Refer the link to create API
GitHub - SoftwareAG/webmethods-api-gateway: Repository hosting developer tutorials, code samples, custom policies, CI/CD scripts and more to enable developers develop faster with API Gateway
• We configured the API on API Gateway. This API checks the availability of beds in hospitals.
• To invoke this API from API Gateway we have implemented the OAuth 2.0 mechanism.
• In our case our API Gateway will be working as an authorization server.
• First we will get the access token from the authorization server and then the same token will be passed to access the API.
OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.
For detailed information follow the below link: OAuth 2.0 — OAuth
**API Name:** CheckBedAvailability
- Open the API CheckBedAvailability.
- Navigate to the policy
- Click on Identify & Access policy.
- Select Identify & Authorize Application.
- Select OAuth2 Token.
- Save the changes.
- Go to the API in our case it is checkBedAvailablity
- Navigate to scopes within the API
- Create the scope and map the resource with it
- In our case scope name is CheckBedAvailibiltyScope
- Add resource name is CheckBedAvailability
- Click Save.
Add Scope to Auth Server
- Click on the administration tab
- Navigate to the Security tab
- From the lefthand tab click on JWT\OAuth\OpenID
- Click on the local authorization server
- Add the scope and save it.
- Click on map Scope
- Give the authorization server scope, In our case, it will be local:OAuthCheckBedAvailabilityScope
- Give the API scope name In our case it will behave given in CheckBedAvailibiltyScope
- Click Save
- Click on create Application and name it as HospitalManagmentApplication.
- Select the API which we want to associate with this application. In our case it will checkBedAvailibility API.
- Click on Authentication and then click on Create Strategy
- Select Authentication scheme as OAuth2
- Provide the name for the strategy
- Select the authentication server as local.
- Enable the generate the credentials
- Select application type as Confidential
- Application profile as web
- Select Grant Type as “Client_credentials”
- Select the scope in our case it will be OAuthCheckBedAvailabilityScope
- Click on Add.
- It will generate the client ID and client credentials, which will be used to generate the access token.
- Select Authorization as OAuth 2.0
- Set the below values
Access Token: https://.gateway.webmethodscloud.com/invoke/pub.apigateway.oauth2/getAccessToken
Grant Type: Client Credentials
Client ID: Available in the application
Client Secret: Available in the application
Client Authentication: Send As Basic Auth header
- Click on generate token
- Click on use token
- Submit the request
- Validate the response.