Configuring Oracle Access Management for WSM OAuth 2.0

A Configuring Oracle Access Management for WSM OAuth 2.0

This appendix provides an optional example of configuring Oracle Access Management (OAM) to issue OAuth access tokens compatible with Oracle Communications Billing and Revenue Management (BRM) Web Services Manager. OAM is not a required WSM runtime dependency.

Topics in this appendix:

The examples use HTTPS endpoints and placeholders in italics. Replace each placeholder with your deployment’s value before running a command.

Preparing Oracle Access Management

Install a BRM-compatible version of Oracle Access Management. For supported versions, see BRM Compatibility Matrix. For installation information, see Oracle Fusion Middleware Installing and Configuring Oracle Identity and Access Management.

The remaining procedures use encodedAdmin, which is the Base64 encoding of the Oracle Access Management administration username and password separated by a colon (adminUsername:adminPassword). Use an account authorized to administer OAuth artifacts.

Creating an OAuth Identity Domain

Create an OAuth identity domain under which to create the resource server and OAuth client.

To create an identity domain, submit a request to the Add a new OAuth Identity Domain operation in the Oracle Access Management OAuth REST API. For example:

curl -i --request POST \
     https://oamAdminHost:oamAdminPort/oam/services/rest/ssa/api/v1/oauthpolicyadmin/oauthidentitydomain
     --header "Content-Type: application/json" \
     --header "Accept: application/json" \
     --header "Authorization: Basic encodedAdmin" \
     --data '{"name": "identityDomain", "description": "WSM OAuth domain", "tokenSettings":[ { "tokenType": "ACCESS_TOKEN", "tokenExpiry": 3600 } ] }'

where:

encodedAdmin is the Base64 encoding of the Oracle Access Management administration username and password separated by a colon (adminUsername:adminPassword).
oamAdminHost:oamAdminPort is the host name and port for the Oracle Access Management administration server.
identityDomain is the name of the Oracle Access Management identity domain that you want to create.

For more information, see "Add a new OAuth Identity Domain" in REST API for OAuth in Oracle Access Manager.

Creating a Resource Server

Create an OAM resource-server registration and a scope for the client token requests.

To create a resource server, submit a request to the Add a new Resource Server operation in the Oracle Access Management OAuth REST API. For example:

curl -i --request POST \
      https://oamAdminHost:oamAdminPort/oam/services/rest/ssa/api/v1/oauthpolicyadmin/application \
     --header "Authorization: Basic encodedAdmin" \
     --header "Content-Type: application/json" \
     --header "Accept: application/json" \
     --data '{ "name": "resourceServer", "idDomain": "identityDomain", "description": "WSM resource registration", "scopes":[ { "scopeName":"OAUTH1", "description":"WSM access token" } ] }'

where resourceServer is the name of the resource server that you want to create. Its qualified scope is resourceServer.OAUTH1. Use the same value when creating the client and requesting tokens.

For more information, see "Add a new Resource Server" in REST API for OAuth in Oracle Access Manager.

Creating an OAuth Client

To create an OAuth client, submit a request to the Add a new OAuth Client operation in the Oracle Access Management OAuth REST API. For example:

curl -i --request POST \
     https://oamAdminHost:oamAdminPort/oam/services/rest/ssa/api/v1/oauthpolicyadmin/client \
     --header "Authorization: Basic encodedAdmin" \
     --header "Content-Type: application/json" \
     --header "Accept: application/json" \
     --data '{"secret":"clientSecret","id":"clientId","name":"clientName","scopes":["resourceServer.OAUTH1"],"clientType":"CONFIDENTIAL_CLIENT","idDomain":"identityDomain","description":"WSM client","grantTypes":["CLIENT_CREDENTIALS"],"defaultScope":"resourceServer.OAUTH1"}'

where:

clientId and clientSecret are the client ID and client secret.
clientName is the name of the OAuth client that you want to create.

For more information, see "Add a new OAuth Client" in REST API for OAuth in Oracle Access Manager.

Validating Your OAuth Setup

Verify token issuance and inspection in OAM before configuring the signing certificate in Web Services Manager.

Generate an OAuth access token by using the Create Access Token Flow operation:

curl -i --request POST \
     https://oamManagedServerHost:oamManagedServerPort/oauth2/rest/token \
     --header 'Authorization: Basic encodedAdmin' \
     --header "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
     --header "X-OAUTH-IDENTITY-DOMAIN-NAME: identityDomain" \
     --data-urlencode 'grant_type=CLIENT_CREDENTIALS' \
     --data-urlencode 'scope=resourceServer.OAUTH1'

A successful response has status 200 and includes accessToken and expiresIn.

For more information, see "Create Access Token Flow" in REST API for OAuth in Oracle Access Manager.

Inspect the access token by using the Validate Access Token Flow operation:
```
curl -i --get \
     https://oamManagedServerHost:oamManagedServerPort/oauth2/rest/token/info
     --header 'X-OAUTH-IDENTITY-DOMAIN-NAME: identityDomain' \
     --data-urlencode 'access_token=accessToken'
```
where accessToken is the access token returned in step 1. A successful response has status 200 and includes token details. Treat the token as a credential, including in command history and URL logs.

For more information, see "Validate Access Token Flow" in REST API for OAuth in Oracle Access Manager.

These checks validate the OAM configuration. They do not verify WSM protection. After configuring WSM, submit an authenticated SOAP invocation as described in "Sending SOAP Requests to BRM Web Services".

Retrieving the Token-Signing Certificate

Retrieve the identity domain’s public signing certificate by using the Fetch the public certificate of a given Identity Domain operation:

curl -i --get \
  'https://oamManagedServerHost:oamManagedServerPort/oauth2/rest/security' \
  --header 'Authorization: Basic encodedClient' \
  --header 'Cache-Control: no-cache' \
  --data-urlencode 'identityDomainName=identityDomain'

where encodedClient is the Base64-encoded format of the client ID and client secret separated by a colon (clientId:clientSecret).

For more information, see "Fetch the public certificate of a given Identity Domain" in REST API for OAuth in Oracle Access Manager.

The response contains a keys array. Select the RS256 signing key and obtain the certificate from its x5c array. Save the Base64 certificate value, without JSON quotes or array delimiters, in PEM format:

-----BEGIN CERTIFICATE-----
base64SigningCertificate
-----END CERTIFICATE-----

Configure WSM with this certificate by following the instructions in "Setting Up Web Services Manager with OAuth 2.0".