Skip to content

Commit c3f6f1e

Browse files
UdeshAthukoralaUdeshAthukorala
authored
Merge pull request #6139 from UdeshAthukorala/action-oauth2-authentication
Document OAuth2 client credentials and password grant based authentication support for actions
2 parents cffae20 + 941d994 commit c3f6f1e

6 files changed

Lines changed: 178 additions & 16 deletions

File tree

‎en/asgardeo/docs/apis/organization-apis/restapis/actions.yaml‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1192,12 +1192,12 @@ components:
11921192
type: object
11931193
description: >
11941194
The type of authentication required by the action's endpoint. The following options are supported:
1195-
1195+
11961196
- NONE: No authentication is required. <br>
11971197
``{
11981198
"type": "NONE"
11991199
}``
1200-
1200+
12011201
- BASIC: Basic authentication with a username and password.<br>
12021202
``{
12031203
"type": "BASIC",
@@ -1206,7 +1206,7 @@ components:
12061206
"password": "auth_password"
12071207
}
12081208
}``
1209-
1209+
12101210
- API_KEY: API key-based authentication, where the key is provided in an HTTP header.<br>
12111211
``{
12121212
"type": "API_KEY",
@@ -1215,14 +1215,38 @@ components:
12151215
"value": "12345-abcde-67890"
12161216
}
12171217
}``
1218-
1218+
12191219
- BEARER: Bearer token-based authentication.<br/>
12201220
``{
12211221
"type": "BEARER",
12221222
"properties": {
12231223
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
12241224
}
12251225
}``
1226+
1227+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
1228+
``{
1229+
"type": "CLIENT_CREDENTIAL",
1230+
"properties": {
1231+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1232+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1233+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1234+
"scopes": "send_scope"
1235+
}
1236+
}``
1237+
1238+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
1239+
``{
1240+
"type": "PASSWORD_CREDENTIAL",
1241+
"properties": {
1242+
"username": "alice",
1243+
"password": "p@ssw0rd!",
1244+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1245+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1246+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1247+
"scopes": "send_scope"
1248+
}
1249+
}``
12261250
required:
12271251
- type
12281252
properties:
@@ -1233,6 +1257,8 @@ components:
12331257
- BEARER
12341258
- API_KEY
12351259
- BASIC
1260+
- CLIENT_CREDENTIAL
1261+
- PASSWORD_CREDENTIAL
12361262
example: BASIC
12371263
properties:
12381264
type: object
@@ -1257,8 +1283,18 @@ components:
12571283
- BEARER
12581284
- API_KEY
12591285
- BASIC
1286+
- CLIENT_CREDENTIAL
1287+
- PASSWORD_CREDENTIAL
12601288
description: Type of the authentication.
12611289
example: BASIC
1290+
properties:
1291+
type: object
1292+
description: Authentication properties (without secrets) specific to the selected type.
1293+
additionalProperties: true
1294+
example:
1295+
type: BASIC
1296+
properties:
1297+
username: "auth_username"
12621298

12631299
ActionUpdateModel:
12641300
type: object

‎en/asgardeo/docs/apis/restapis/actions.yaml‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1456,12 +1456,12 @@ components:
14561456
type: object
14571457
description: >
14581458
The type of authentication required by the action's endpoint. The following options are supported:
1459-
1459+
14601460
- NONE: No authentication is required. <br>
14611461
``{
14621462
"type": "NONE"
14631463
}``
1464-
1464+
14651465
- BASIC: Basic authentication with a username and password.<br>
14661466
``{
14671467
"type": "BASIC",
@@ -1470,7 +1470,7 @@ components:
14701470
"password": "auth_password"
14711471
}
14721472
}``
1473-
1473+
14741474
- API_KEY: API key-based authentication, where the key is provided in an HTTP header.<br>
14751475
``{
14761476
"type": "API_KEY",
@@ -1479,14 +1479,38 @@ components:
14791479
"value": "12345-abcde-67890"
14801480
}
14811481
}``
1482-
1482+
14831483
- BEARER: Bearer token-based authentication.<br/>
14841484
``{
14851485
"type": "BEARER",
14861486
"properties": {
14871487
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
14881488
}
14891489
}``
1490+
1491+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
1492+
``{
1493+
"type": "CLIENT_CREDENTIAL",
1494+
"properties": {
1495+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1496+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1497+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1498+
"scopes": "send_scope"
1499+
}
1500+
}``
1501+
1502+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
1503+
``{
1504+
"type": "PASSWORD_CREDENTIAL",
1505+
"properties": {
1506+
"username": "alice",
1507+
"password": "p@ssw0rd!",
1508+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1509+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1510+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1511+
"scopes": "send_scope"
1512+
}
1513+
}``
14901514
required:
14911515
- type
14921516
properties:
@@ -1497,6 +1521,8 @@ components:
14971521
- BEARER
14981522
- API_KEY
14991523
- BASIC
1524+
- CLIENT_CREDENTIAL
1525+
- PASSWORD_CREDENTIAL
15001526
example: BASIC
15011527
properties:
15021528
type: object
@@ -1521,8 +1547,18 @@ components:
15211547
- BEARER
15221548
- API_KEY
15231549
- BASIC
1550+
- CLIENT_CREDENTIAL
1551+
- PASSWORD_CREDENTIAL
15241552
description: Type of the authentication.
15251553
example: BASIC
1554+
properties:
1555+
type: object
1556+
description: Authentication properties (without secrets) specific to the selected type.
1557+
additionalProperties: true
1558+
example:
1559+
type: BASIC
1560+
properties:
1561+
username: "auth_username"
15261562

15271563
ActionUpdateModel:
15281564
type: object

‎en/identity-server/next/docs/apis/organization-apis/restapis/actions.yaml‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1195,12 +1195,12 @@ components:
11951195
type: object
11961196
description: >
11971197
The type of authentication required by the action's endpoint. The following options are supported:
1198-
1198+
11991199
- NONE: No authentication is required. <br>
12001200
``{
12011201
"type": "NONE"
12021202
}``
1203-
1203+
12041204
- BASIC: Basic authentication with a username and password.<br>
12051205
``{
12061206
"type": "BASIC",
@@ -1209,7 +1209,7 @@ components:
12091209
"password": "auth_password"
12101210
}
12111211
}``
1212-
1212+
12131213
- API_KEY: API key-based authentication, where the key is provided in an HTTP header.<br>
12141214
``{
12151215
"type": "API_KEY",
@@ -1218,14 +1218,38 @@ components:
12181218
"value": "12345-abcde-67890"
12191219
}
12201220
}``
1221-
1221+
12221222
- BEARER: Bearer token-based authentication.<br/>
12231223
``{
12241224
"type": "BEARER",
12251225
"properties": {
12261226
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
12271227
}
12281228
}``
1229+
1230+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
1231+
``{
1232+
"type": "CLIENT_CREDENTIAL",
1233+
"properties": {
1234+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1235+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1236+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1237+
"scopes": "send_scope"
1238+
}
1239+
}``
1240+
1241+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
1242+
``{
1243+
"type": "PASSWORD_CREDENTIAL",
1244+
"properties": {
1245+
"username": "alice",
1246+
"password": "p@ssw0rd!",
1247+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1248+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1249+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1250+
"scopes": "send_scope"
1251+
}
1252+
}``
12291253
required:
12301254
- type
12311255
properties:
@@ -1236,6 +1260,8 @@ components:
12361260
- BEARER
12371261
- API_KEY
12381262
- BASIC
1263+
- CLIENT_CREDENTIAL
1264+
- PASSWORD_CREDENTIAL
12391265
example: BASIC
12401266
properties:
12411267
type: object
@@ -1260,8 +1286,18 @@ components:
12601286
- BEARER
12611287
- API_KEY
12621288
- BASIC
1289+
- CLIENT_CREDENTIAL
1290+
- PASSWORD_CREDENTIAL
12631291
description: Type of the authentication.
12641292
example: BASIC
1293+
properties:
1294+
type: object
1295+
description: Authentication properties (without secrets) specific to the selected type.
1296+
additionalProperties: true
1297+
example:
1298+
type: BASIC
1299+
properties:
1300+
username: "auth_username"
12651301

12661302
ActionUpdateModel:
12671303
type: object

‎en/identity-server/next/docs/apis/restapis/actions.yaml‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1463,12 +1463,12 @@ components:
14631463
type: object
14641464
description: >
14651465
The type of authentication required by the action's endpoint. The following options are supported:
1466-
1466+
14671467
- NONE: No authentication is required. <br>
14681468
``{
14691469
"type": "NONE"
14701470
}``
1471-
1471+
14721472
- BASIC: Basic authentication with a username and password.<br>
14731473
``{
14741474
"type": "BASIC",
@@ -1477,7 +1477,7 @@ components:
14771477
"password": "auth_password"
14781478
}
14791479
}``
1480-
1480+
14811481
- API_KEY: API key-based authentication, where the key is provided in an HTTP header.<br>
14821482
``{
14831483
"type": "API_KEY",
@@ -1486,14 +1486,38 @@ components:
14861486
"value": "12345-abcde-67890"
14871487
}
14881488
}``
1489-
1489+
14901490
- BEARER: Bearer token-based authentication.<br/>
14911491
``{
14921492
"type": "BEARER",
14931493
"properties": {
14941494
"accessToken": "0d6fed02-eac0-332b-8998-213a543139a0"
14951495
}
14961496
}``
1497+
1498+
- CLIENT_CREDENTIAL: OAuth2 client credentials grant based authentication.<br/>
1499+
``{
1500+
"type": "CLIENT_CREDENTIAL",
1501+
"properties": {
1502+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1503+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1504+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1505+
"scopes": "send_scope"
1506+
}
1507+
}``
1508+
1509+
- PASSWORD_CREDENTIAL: OAuth2 resource owner password credentials grant based authentication.<br/>
1510+
``{
1511+
"type": "PASSWORD_CREDENTIAL",
1512+
"properties": {
1513+
"username": "alice",
1514+
"password": "p@ssw0rd!",
1515+
"clientId": "3e172dd2-901b-43a9-a26a-728466795f01",
1516+
"clientSecret": "83cdc120-ccf6-4163-a4a8-c1ba3e872daa",
1517+
"tokenEndpoint": "https://custom.idp.com/oauth2/token",
1518+
"scopes": "send_scope"
1519+
}
1520+
}``
14971521
required:
14981522
- type
14991523
properties:
@@ -1504,6 +1528,8 @@ components:
15041528
- BEARER
15051529
- API_KEY
15061530
- BASIC
1531+
- CLIENT_CREDENTIAL
1532+
- PASSWORD_CREDENTIAL
15071533
example: BASIC
15081534
properties:
15091535
type: object
@@ -1528,8 +1554,18 @@ components:
15281554
- BEARER
15291555
- API_KEY
15301556
- BASIC
1557+
- CLIENT_CREDENTIAL
1558+
- PASSWORD_CREDENTIAL
15311559
description: Type of the authentication.
15321560
example: BASIC
1561+
properties:
1562+
type: object
1563+
description: Authentication properties (without secrets) specific to the selected type.
1564+
additionalProperties: true
1565+
example:
1566+
type: BASIC
1567+
properties:
1568+
username: "auth_username"
15331569

15341570
ActionUpdateModel:
15351571
type: object

‎en/includes/guides/service-extensions/pre-flow-extensions/action-versions/pre-issue-id-token-action-v1.x.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -560,6 +560,13 @@ Configure the authentication scheme when registering the action in {{product_nam
560560
- **Basic**: HTTP Basic authentication.
561561
- **Bearer**: OAuth 2.0 Bearer token in the <code>Authorization</code> header.
562562
- **API Key**: API key in a header; you can define the header name (for example, <code>X-API-Key</code>).
563+
{% if (product_name == "WSO2 Identity Server" and is_version > "7.3.0") or product_name == "Asgardeo" %}
564+
- **OAuth 2.0 Client Credentials**: {{product_name}} retrieves an access token from the configured token endpoint using the OAuth 2.0 client credentials grant and uses it as a bearer token when invoking the action endpoint.
565+
- **OAuth 2.0 Password Grant**: {{product_name}} retrieves an access token from the configured token endpoint using the OAuth 2.0 resource owner password credentials grant and uses it as a bearer token when invoking the action endpoint.
566+
567+
!!! warning
568+
If you use your own {{product_name}} organization as the authorization server (that is, the configured token endpoint belongs to the same organization and the OAuth 2.0 application used to obtain the access token resides in the same organization), exclude that application from this **Pre-Issue ID Token** action (and the **Pre-Issue Access Token** action) by configuring a rule. Otherwise the token issuance flow will fall into a cyclic dependency, since the action invocation triggers a token request, which in turn triggers the same action again. As a result, the ID token and access token issuance will break.
569+
{% endif %}
563570

564571
## Conditional invocation of pre-issue id token action
565572

0 commit comments

Comments
 (0)