Skip to content

Commit 0565f5f

Browse files
UdeshAthukoralaUdeshAthukorala
committed
Document OAuth2 client credentials and password grant based authentication support for custom authenticators
1 parent 391ca5e commit 0565f5f

10 files changed

Lines changed: 218 additions & 0 deletions

File tree

‎en/asgardeo/docs/apis/organization-apis/restapis/authenticators.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -491,6 +491,30 @@ components:
491491
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
492492
}
493493
}``
494+
495+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
496+
``{
497+
"type": "CLIENT_CREDENTIAL",
498+
"properties": {
499+
"clientId": "auth_clientId",
500+
"clientSecret": "auth_clientSecret",
501+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
502+
"scopes": "send_scope"
503+
}
504+
}``
505+
506+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
507+
``{
508+
"type": "PASSWORD_CREDENTIAL",
509+
"properties": {
510+
"username": "auth_username",
511+
"password": "auth_password",
512+
"clientId": "auth_clientId",
513+
"clientSecret": "auth_clientSecret",
514+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
515+
"scopes": "send_scope"
516+
}
517+
}``
494518
required:
495519
- type
496520
- properties
@@ -502,6 +526,8 @@ components:
502526
- BEARER
503527
- API_KEY
504528
- BASIC
529+
- CLIENT_CREDENTIAL
530+
- PASSWORD_CREDENTIAL
505531
example: BASIC
506532
properties:
507533
type: object

‎en/asgardeo/docs/apis/organization-apis/restapis/idp.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2325,6 +2325,30 @@ components:
23252325
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
23262326
}
23272327
}``
2328+
2329+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
2330+
``{
2331+
"type": "CLIENT_CREDENTIAL",
2332+
"properties": {
2333+
"clientId": "auth_clientId",
2334+
"clientSecret": "auth_clientSecret",
2335+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2336+
"scopes": "send_scope"
2337+
}
2338+
}``
2339+
2340+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
2341+
``{
2342+
"type": "PASSWORD_CREDENTIAL",
2343+
"properties": {
2344+
"username": "auth_username",
2345+
"password": "auth_password",
2346+
"clientId": "auth_clientId",
2347+
"clientSecret": "auth_clientSecret",
2348+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2349+
"scopes": "send_scope"
2350+
}
2351+
}``
23282352
required:
23292353
- type
23302354
properties:
@@ -2335,6 +2359,8 @@ components:
23352359
- BEARER
23362360
- API_KEY
23372361
- BASIC
2362+
- CLIENT_CREDENTIAL
2363+
- PASSWORD_CREDENTIAL
23382364
example: BASIC
23392365
properties:
23402366
type: object

‎en/asgardeo/docs/apis/restapis/authenticators.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,6 +489,30 @@ components:
489489
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
490490
}
491491
}``
492+
493+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
494+
``{
495+
"type": "CLIENT_CREDENTIAL",
496+
"properties": {
497+
"clientId": "auth_clientId",
498+
"clientSecret": "auth_clientSecret",
499+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
500+
"scopes": "send_scope"
501+
}
502+
}``
503+
504+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
505+
``{
506+
"type": "PASSWORD_CREDENTIAL",
507+
"properties": {
508+
"username": "auth_username",
509+
"password": "auth_password",
510+
"clientId": "auth_clientId",
511+
"clientSecret": "auth_clientSecret",
512+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
513+
"scopes": "send_scope"
514+
}
515+
}``
492516
required:
493517
- type
494518
- properties
@@ -500,6 +524,8 @@ components:
500524
- BEARER
501525
- API_KEY
502526
- BASIC
527+
- CLIENT_CREDENTIAL
528+
- PASSWORD_CREDENTIAL
503529
example: BASIC
504530
properties:
505531
type: object

‎en/asgardeo/docs/apis/restapis/idp.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2669,6 +2669,30 @@ components:
26692669
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
26702670
}
26712671
}``
2672+
2673+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
2674+
``{
2675+
"type": "CLIENT_CREDENTIAL",
2676+
"properties": {
2677+
"clientId": "auth_clientId",
2678+
"clientSecret": "auth_clientSecret",
2679+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2680+
"scopes": "send_scope"
2681+
}
2682+
}``
2683+
2684+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
2685+
``{
2686+
"type": "PASSWORD_CREDENTIAL",
2687+
"properties": {
2688+
"username": "auth_username",
2689+
"password": "auth_password",
2690+
"clientId": "auth_clientId",
2691+
"clientSecret": "auth_clientSecret",
2692+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2693+
"scopes": "send_scope"
2694+
}
2695+
}``
26722696
required:
26732697
- type
26742698
properties:
@@ -2679,6 +2703,8 @@ components:
26792703
- BEARER
26802704
- API_KEY
26812705
- BASIC
2706+
- CLIENT_CREDENTIAL
2707+
- PASSWORD_CREDENTIAL
26822708
example: BASIC
26832709
properties:
26842710
type: object

‎en/identity-server/next/docs/apis/organization-apis/restapis/authenticators.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,30 @@ components:
494494
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
495495
}
496496
}``
497+
498+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
499+
``{
500+
"type": "CLIENT_CREDENTIAL",
501+
"properties": {
502+
"clientId": "auth_clientId",
503+
"clientSecret": "auth_clientSecret",
504+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
505+
"scopes": "send_scope"
506+
}
507+
}``
508+
509+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
510+
``{
511+
"type": "PASSWORD_CREDENTIAL",
512+
"properties": {
513+
"username": "auth_username",
514+
"password": "auth_password",
515+
"clientId": "auth_clientId",
516+
"clientSecret": "auth_clientSecret",
517+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
518+
"scopes": "send_scope"
519+
}
520+
}``
497521
required:
498522
- type
499523
- properties
@@ -505,6 +529,8 @@ components:
505529
- BEARER
506530
- API_KEY
507531
- BASIC
532+
- CLIENT_CREDENTIAL
533+
- PASSWORD_CREDENTIAL
508534
example: BASIC
509535
properties:
510536
type: object

‎en/identity-server/next/docs/apis/organization-apis/restapis/idp.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2350,6 +2350,30 @@ components:
23502350
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
23512351
}
23522352
}``
2353+
2354+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
2355+
``{
2356+
"type": "CLIENT_CREDENTIAL",
2357+
"properties": {
2358+
"clientId": "auth_clientId",
2359+
"clientSecret": "auth_clientSecret",
2360+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2361+
"scopes": "send_scope"
2362+
}
2363+
}``
2364+
2365+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
2366+
``{
2367+
"type": "PASSWORD_CREDENTIAL",
2368+
"properties": {
2369+
"username": "auth_username",
2370+
"password": "auth_password",
2371+
"clientId": "auth_clientId",
2372+
"clientSecret": "auth_clientSecret",
2373+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
2374+
"scopes": "send_scope"
2375+
}
2376+
}``
23532377
required:
23542378
- type
23552379
properties:
@@ -2360,6 +2384,8 @@ components:
23602384
- BEARER
23612385
- API_KEY
23622386
- BASIC
2387+
- CLIENT_CREDENTIAL
2388+
- PASSWORD_CREDENTIAL
23632389
example: BASIC
23642390
properties:
23652391
type: object

‎en/identity-server/next/docs/apis/restapis/authenticators.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -493,6 +493,30 @@ components:
493493
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
494494
}
495495
}``
496+
497+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
498+
``{
499+
"type": "CLIENT_CREDENTIAL",
500+
"properties": {
501+
"clientId": "auth_clientId",
502+
"clientSecret": "auth_clientSecret",
503+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
504+
"scopes": "send_scope"
505+
}
506+
}``
507+
508+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
509+
``{
510+
"type": "PASSWORD_CREDENTIAL",
511+
"properties": {
512+
"username": "auth_username",
513+
"password": "auth_password",
514+
"clientId": "auth_clientId",
515+
"clientSecret": "auth_clientSecret",
516+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
517+
"scopes": "send_scope"
518+
}
519+
}``
496520
required:
497521
- type
498522
- properties
@@ -504,6 +528,8 @@ components:
504528
- BEARER
505529
- API_KEY
506530
- BASIC
531+
- CLIENT_CREDENTIAL
532+
- PASSWORD_CREDENTIAL
507533
example: BASIC
508534
properties:
509535
type: object

‎en/identity-server/next/docs/apis/restapis/configs.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1541,6 +1541,8 @@ components:
15411541
- BEARER
15421542
- API_KEY
15431543
- BASIC
1544+
- CLIENT_CREDENTIAL
1545+
- PASSWORD_CREDENTIAL
15441546
example: BASIC
15451547
properties:
15461548
type: object

‎en/identity-server/next/docs/apis/restapis/idp.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3315,6 +3315,30 @@ components:
33153315
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
33163316
}
33173317
}``
3318+
3319+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
3320+
``{
3321+
"type": "CLIENT_CREDENTIAL",
3322+
"properties": {
3323+
"clientId": "auth_clientId",
3324+
"clientSecret": "auth_clientSecret",
3325+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
3326+
"scopes": "send_scope"
3327+
}
3328+
}``
3329+
3330+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
3331+
``{
3332+
"type": "PASSWORD_CREDENTIAL",
3333+
"properties": {
3334+
"username": "auth_username",
3335+
"password": "auth_password",
3336+
"clientId": "auth_clientId",
3337+
"clientSecret": "auth_clientSecret",
3338+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
3339+
"scopes": "send_scope"
3340+
}
3341+
}``
33183342
required:
33193343
- type
33203344
properties:
@@ -3325,6 +3349,8 @@ components:
33253349
- BEARER
33263350
- API_KEY
33273351
- BASIC
3352+
- CLIENT_CREDENTIAL
3353+
- PASSWORD_CREDENTIAL
33283354
example: BASIC
33293355
properties:
33303356
type: object

‎en/includes/guides/service-extensions/in-flow-extensions/custom-authentication.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,10 @@ Your external web service should do the following to integrate as a custom authe
8181
- Basic Authentication: Use HTTP Basic authentication to secure the endpoint.
8282
- OAuth 2.0 Bearer Tokens: Use OAuth 2.0 for token-based authentication.
8383
- API Key Header: Secure the endpoint using an API key sent in the request header.
84+
{% if (product_name == "WSO2 Identity Server" and is_version > "7.3.0") or product_name == "Asgardeo" %}
85+
- OAuth 2.0 Client Credentials Grant: {{product_name}} obtains an access token from your authorization server using the OAuth 2.0 client credentials grant and uses it to call the endpoint.
86+
- OAuth 2.0 Password Grant: {{product_name}} obtains an access token from your authorization server using the OAuth 2.0 resource owner password credentials grant and uses it to call the endpoint.
87+
{% endif %}
8488

8589
!!! tip
8690
During the development phase, you may choose to invoke your external service without security for testing purposes. Always secure your service before deploying it in a production environment.
@@ -112,6 +116,10 @@ Follow the steps below to configure a custom authenticator.
112116
- Basic - Provide a username and password.
113117
- Bearer - Provide a bearer token.
114118
- API Key - Provide the header name and the value.
119+
{% if (product_name == "WSO2 Identity Server" and is_version > "7.3.0") or product_name == "Asgardeo" %}
120+
- OAuth 2.0 Client Credentials - Provide the token endpoint, client ID, client secret, and optionally a space-separated list of scopes. {{product_name}} retrieves a fresh access token from the configured token endpoint using the OAuth 2.0 client credentials grant and uses it as a bearer token when invoking the custom authenticator endpoint.
121+
- OAuth 2.0 Password Grant - Provide the token endpoint, client ID, client secret, username, password, and optionally a space-separated list of scopes. {{product_name}} retrieves a fresh access token from the configured token endpoint using the OAuth 2.0 resource owner password credentials grant and uses it as a bearer token when invoking the custom authenticator endpoint.
122+
{% endif %}
115123
- No Authentication - No authentication (recommended only for testing purposes).
116124

117125
6. If you select **External (Federated) User Authentication**, configure [JIT-User Provisioning]({{base_path}}/guides/authentication/jit-user-provisioning) according to your requirements. Additionally, review and set up [role assignments for user groups]({{base_path}}/guides/users/manage-roles/#assign-external-groups-to-a-role) to ensure seamless integration.

0 commit comments

Comments
 (0)