|
1 | | -# azure-oauth2provider |
| 1 | +# Azure OAuth2Provider |
2 | 2 |
|
| 3 | +If you use the API gateway as an OAuth2 client with Azure, it may be necessary to register a special OAuth2 provider. |
| 4 | +Especially if you use the PKCE flow. The reason is that during the token exchange request Azure requires an Origin header and acknowledges this with the following error message: |
| 5 | +` |
| 6 | +"error":"invalid_request","error_description":"AADSTS9002327: Tokens issued for the 'Single-Page Application' client-type may only be redeemed via cross-origin requests.\r\nTrace ID: 0e8f9824-95f5-481a-8deb-b035b1dd8303\r\nCorrelation ID: 2e1e8f7d-a08a-420e-8908-074c2a9add4d\r\nTimestamp: 2021-07-12 13:45:27Z","error_codes":[9002327],"timestamp":"2021-07-12 13:45:27Z","trace_id":"0e8f9824-95f5-481a-8deb-b035b1dd8303","correlation_id":"2e1e8f7d-a08a-420e-8908-074c2a9add4d"} |
| 7 | +` |
| 8 | + |
| 9 | +This Azure OAuth2Provider will add the required `Origin` header in the Token-Exchange request. |
| 10 | + |
| 11 | + |
| 12 | + |
| 13 | +# Installation & Setup |
| 14 | + |
| 15 | +- Download the release package |
| 16 | +- Copy the JAR-File into your API-Gateway(s) `ext/lib` folder and __restart the API-Gateway(s)__ |
| 17 | +- If you don't have already, setup your OAuth-Client-Provider using Policy-Studio |
| 18 | +- Close the Policy-Studio project |
| 19 | +- Open Policy-Studio project file: `ExtConnsStore-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xml` |
| 20 | +- Locate your configured Azure OAuthProviderProfile and changhe the `class` to `com.axway.oauth.client.providers.AzureOAuth2Provider` as in the example below |
| 21 | +- Re-Open the project in Policy-Studio and deploy the configuration |
| 22 | + |
| 23 | +```xml |
| 24 | +<?xml version="1.0" encoding="UTF-8"?> |
| 25 | +<entity xmlns="http://www.vordel.com/2005/06/24/entityStore" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" type="OAuthProviderProfile" entityPK="6017837698390746166" parentPK="5256084280368879969"> |
| 26 | + <fval name="authzUrl"> |
| 27 | + <value>https://login.microsoftonline.com/........./oauth2/v2.0/authorize</value> |
| 28 | + </fval> |
| 29 | + <fval name="cacheToUse"> |
| 30 | + <value contentType="reference"> |
| 31 | + <key type="CacheManager"> |
| 32 | + <id field="name" value="Cache Manager" /> |
| 33 | + <key type="Cache"> |
| 34 | + <id field="name" value="OAuth Client State Cache" /> |
| 35 | + </key> |
| 36 | + </key> |
| 37 | + </value> |
| 38 | + </fval> |
| 39 | + <fval name="class"> |
| 40 | + <value>com.axway.oauth.client.providers.AzureOAuth2Provider</value> |
| 41 | + </fval> |
| 42 | + <fval name="name"> |
| 43 | + <value>Azure AD</value> |
| 44 | + </fval> |
| 45 | + <fval name="tokenStore"> |
| 46 | + <value contentType="reference"> |
| 47 | + <key type="OAuth2StoresGroup"> |
| 48 | + <id field="name" value="OAuth2 Stores" /> |
| 49 | + <key type="ClientAccessTokenStoreGroup"> |
| 50 | + <id field="name" value="Client Access Token Stores" /> |
| 51 | + <key type="ClientAccessTokenPersist"> |
| 52 | + <id field="name" value="OAuth Client Access Token Store" /> |
| 53 | + </key> |
| 54 | + </key> |
| 55 | + </key> |
| 56 | + </value> |
| 57 | + </fval> |
| 58 | + <fval name="tokenUrl"> |
| 59 | + <value>https://login.microsoftonline.com/........./oauth2/v2.0/token</value> |
| 60 | + </fval> |
| 61 | +</entity> |
| 62 | +``` |
| 63 | + |
| 64 | +## API Management Version Compatibilty |
| 65 | + |
| 66 | +This artefact has been tested with API-Management Versions |
| 67 | + |
| 68 | +| Version | Comment | |
| 69 | +| :--- | :--- | |
| 70 | +| 7.7-20210530 | | |
| 71 | +| 7.7-20210330 | | |
| 72 | +| 7.7-20200930 | | |
| 73 | + |
| 74 | +Please let us know, if you encounter any [issues](https://github.com/Axway-API-Management-Plus/openapi-validator/issues) with your API-Manager version. |
| 75 | + |
| 76 | +## Contributing |
| 77 | + |
| 78 | +Please read [Contributing.md](https://github.com/Axway-API-Management-Plus/Common/blob/master/Contributing.md) for details on our code of conduct, and the process for submitting pull requests to us. |
| 79 | + |
| 80 | +## Team |
| 81 | + |
| 82 | +![alt text][Axwaylogo] Axway Team |
| 83 | + |
| 84 | +[Axwaylogo]: https://github.com/Axway-API-Management/Common/blob/master/img/AxwayLogoSmall.png "Axway logo" |
| 85 | + |
| 86 | + |
| 87 | +## License |
| 88 | +[Apache License 2.0](/LICENSE) |
0 commit comments