Configuring OAuth 2.0 Authentication

To configure OAuth 2.0 authentication:

For an existing deployment, back up the deployed system-config.properties file in UIM_Home/config. For a new installation, configure the properties before starting the managed servers.
Configure the existing OAuth properties, including:
```
oauth.enabled=true
```
Uncomment or add the UIM REST API OAuth properties for token introspection, username claim, role or group claim, and excluded paths.
Configure the identity-provider certificate chain in the JVM trust store used by the UIM managed servers, if the identity-provider endpoint certificate is not already trusted.
Start the managed servers if you configured the properties before startup. For an existing deployment, restart each UIM managed server.
In a clustered deployment, update and start or restart every managed server so that all nodes use the same OAuth configuration.
Verify that the token user is represented by the configured username claim and that the configured role or group claim includes uim-users for UIM REST API access.
Verify Bearer authentication against each server or through the load balancer.
The following system-config.properties sample shows only the UIM REST API OAuth properties. Replace the placeholder values with values for your deployment.
```
# newly added for UIM REST APIs
oauth.introspection.endpoint.uri=http://<hostname>:<port>/auth/realms/UIM/protocol/openid-connect/token/introspect
oauth.roles.claim=groups
oauth.username.claim=upn
```