Oracle® Fusion Middleware
Part 1. API Gateway as an OAuth server

This chapter describes how to configure the OAuth 2.0 support provided with the API Gateway. It describes how to enable the OAuth 2.0 endpoints used to manage client applications, and how to import the preregistered examples provided with the API Gateway. It also explains how to migrate existing OAuth 2.0 applications.

The OAuth service is not available in the basic installation. You must deploy it manually. A convenience script is provided in $VDISTDIR/samples/scripts/oauth for deploying the OAuth 2.0 services listener, supporting policies, and sample applications. VDISTDIR is the directory in which API Gateway is installed. You can run the script from $VDISTDIR/samples/scripts as follows:

UNIX/Linux

./run.sh oauth/deployOAuthConfig.py --type=authzserver 

Windows

run.bat oauth\deployOAuthConfig.py --type=authzserver

The parameters for the script are as follows:

  Usage: deployOAuthConfig.py [options]

  Options:
    -h, --help            show this help message and exit
    -u USERNAME, --username=USERNAME
                          The user to connect to the topology (default 'admin')
    -p PASSWORD, --password=PASSWORD
                          The password for the user to connect to the topology
                          connect user (default 'changeme')
    --port=PORT           The port the Client Application Registry is listening on
                          (default 8089)
    --admin=ADMIN         The Client Application Registry admin name (default
                          regadmin)
    --adminpw=ADMINPW     The Client Application Registry admin password
                          (default changeme)
    --type=TYPE           The deployment type: "authzserver", "clientdemo" or
                          "all" (default all)
    -g GROUP, --group=GROUP
                          The group name
    -n SERVICE, --service=SERVICE
                          The service name

The API Gateway provides the following endpoints used to manage OAuth 2.0 client applications:

In this table, apigateway refers to the machine on which API Gateway is installed.

	Important
	You must first enable the OAuth listener port in the API Gateway before these endpoints are available.

Enable OAuth endpoints

To enable the OAuth management endpoints on your API Gateway, perform the following steps:

1. In the Policy Studio tree view, select Listeners > API Gateway > OAuth 2.0 Services > Ports.

2. Right-click the OAuth 2.0 Interface in the panel on the right, and select Edit.

3. Select Enable Interface in the dialog.

4. Click the Deploy button in the toolbar.

5. Enter a description and click Finish.

	Note
	On Linux-based systems, such as Oracle Enterprise Linux, you must open the firewall to allow external access to port 8089. If you need to change the port number, set the value of the env.PORT.OAUTH2.SERVICES environment variable. For details on setting external environment variables for API Gateway instances, see the API Gateway Deployment and Promotion Guide.

The API Gateway ships with a number of preregistered sample client applications. If you have used the deployOAuthConfig.py script to deploy the OAuth service, these samples will already be imported. If the script was not used, the samples will not be imported. For more information on using the deployOAuthConfig.py script, see the section called “Enable OAuth 2.0 management”. This section explains how to manually import the sample applications into the Client Application Registry.

	Note
	The sample client applications are for demonstration purposes only and should be removed before moving the Authorization Server into production.

For example, the default example client applications include the following:

$VDISTDIR/samples/scripts/oauth/importSampleData.py

If you are migrating from API Gateway version 11.1.2.0.x, you can use the following script to migrate your existing OAuth client applications:

$VDISTDIR/samples/scripts/oauth/migrateFrom71.py 

This script enables you to first export your existing client application data, which you can then import as described in the section called “Import client applications”. This script has a --password parameter if you wish to encrypt the exported data for transport.

If you are migrating from a previous API Gateway version, you must upgrade your API Gateway configuration. To generate an upgraded API Gateway version 11.1.2.3.0 configuration, perform the following steps:

For more details on upgrading API Gateway configuration, see the API Gateway Installation and Configuration Guide.