How OAuth 2.0 Authentication Works at Runtime

OAuth 2.0 authentication works as follows during runtime:

1. Receives a REST request with a Bearer authentication header for a REST endpoint URL.
2. (Optional) OAuth validation is skipped for paths specified in the oauth.excluded.paths property.
3. Validates the access token with the identity provider by using the configured token-introspection URL.
4. Accepts the request only when the token is active and meets the configured audience requirement, if audience validation is configured.
5. Establishes the authenticated caller from the configured username claim and reads UIM REST API group membership from the configured role or group claim. For example, the groups claim contains uim-users.

   Note:

   Missing, malformed, expired, inactive, invalid, or non-validatable tokens result in an authentication failure.