OAuth

Error rendering macro 'pagetree' : could not load an entity: [com.atlassian.confluence.pages.AbstractHierarchical#53194183]

OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

Using OAuth you can enable Single Sign Ons for the following portals:

Configuration in application

To Configure SSO for Azure from Apex, perform the following steps:

1. Navigate to Admin > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel.
   

   Figure: OAuth Authentication Type
   

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

Facebook

To enable Single Sign on for Facebook from Apex, the following configuration should be done in Facebook application:

For Web Application

Prerequisites to be performed in Facebook

1. Log into Facebook using https://developers.facebook.com/. Click Log In.
    Figure: Login Page
   

2. The Facebook login page is displayed. Specify your User Name and Password and click Log In. If you do not have an account already, click Create New Account to Sign up.
    Figure: Facebook Login Screen
   

3. On the top right corner, hover your mouse over My Apps, and then click Add a New App. Figure: Add a New App
   

4. Create a New App ID pop-up page is displayed. Specify a Display Name and Contact Email, and then click Create App ID.
   Figure: Create App ID page
   

5. You are redirected to the Dashboard page. The App ID is displayed on the top left corner of the page. Click Show to view the App Secret.

Note:

• • The App ID displayed here should be entered in the Client ID field of application.

  • The Client Secret displayed here should be entered in the Client Secret Key field of application.

Figure: Dashboard page

1. Click Settings > Basic. Specify the required information in the fields. Select the Category as Utility & Productivity.
   Figure: Settings page
   

2. Click Add Platform. The Select Platform pop-up page is displayed. Select Website.
   Figure: Select Platform Page
   

3. Specify the Site URL and click Save Changes.
   Figure: Basic Settings page
   

4. Click Advanced and Allow API Access to App Settings.
   Figure: Advanced Settings Page
   

5. Click Save Changes.
   

6. Click App Review and make your app Public by clicking Yes.
   Figure: App Review Page
   

7. Click Add Product and select Facebook Login.
   Figure: Add Product
   

8. Under the Valid OAuth redirect URLs section, specify a Re-direct URL.
   Figure: Redirect URL

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

Configuration in application  

To Configure SSO for Facebook from Apex, perform the following steps:

1. Select Admin > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel. 

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

For Mobile  

Prerequisites to be performed in Facebook

1. Log into Facebook using https://developers.facebook.com/. Click Log In.
    Figure: Login Page
   

2. The Facebook login page is displayed. Specify your User Name and Password and click Log In. If you do not have an account already, click Create New Account to Sign up.
    Figure: Facebook Login Screen
   

3. On the top right corner, hover your mouse over My Apps, and then click Add a New App.
   Figure: Add a New App
   

4. Create a New App ID pop-up page is displayed. Specify a Display Name and Contact Email, and then click Create App ID.
   Figure: Create App ID page
   

5. You are redirected to the Dashboard page. The App ID is displayed on the top left corner of the page. Click Show to view the App Secret.

Note:

• The App ID displayed here should be entered in the Client ID field of application.

• The Client Secret displayed here should be entered in the Client Secret Key field of application.

Figure: Dashboard page

1. Click Settings > Basic. Specify the required information in the fields. Select the Category as Utility & Productivity.
   
    
   Figure: Settings page

2. Click Add Platform. The Select Platform pop-up page is displayed. Select Website.
   
    
   Figure: Select Platform Page

3. Specify the Site URL and click Save Changes.
   
    
   Figure: Basic Settings page

4. Click Advanced and Allow API Access to App Settings.
   
    
   Figure: Advanced Settings Page

5. Click Save Changes.

6. Click App Review and make your app Public by clicking Yes.
   
    
   Figure: App Review Page

7. Click Add Product and select Facebook Login.
   
    
   Figure: Add Product

8. Under the Valid OAuth redirect URLs section, specify a Re-direct URL.
   
    
   Figure: Redirect URL

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

Configuration in application  

To Configure SSO for Facebook from Apex, perform the following:

1. Select Admin > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel.

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

Okta

To enable Single Sign on for Okta from Apex, the following configuration should be done in Okta portal.

For Web Application

Prerequisites to be performed in Okta Portal

Prerequisites to be performed in Okta Portal  

1. Sign up in Okta portal using https://www.okta.com/developer/signup/.
    Figure:  Sign up
   

2. Click Get Started. Your login URL is displayed. Login to Okta using this URL. You will receive a confirmation mail. Set your password by clicking this link.
   Figure:  Okta URL

3. Specify your User Name and Password and click Sign In.
   Figure:  Okta Login page

4. On the top menu, select Security > API.
   Figure:  Security Menu

5. On the API page, click Authorization Servers.
   Figure:  API Page

6. On the Add Authorization Server pop-up page, Specify Name, Audience, and Description. For more information about these fields, refer https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html.
   Figure:  Add Authorization URL Pop-up page

7. Under the Settings section, the issuer field is displayed. Store this URL securely. Figure: Settings section

Note:

The Issuer URL displayed here should be entered in the Authorization URL, Access Token URL, and User Info URL fields of application.

1. Select Access Policies and click Add Policy. The Add Policy pop-up page is displayed.
    Figure:  Add Policies pop-up page

2. On the Add Policy pop-up page, specify the Name, and Description and click Create Policy.
    Figure:  Add Policy page.

3. On the Add New Access Policy page, create Add Rule.
    Figure:  Add New Access Policy Page

4. On the Add Rule pop-up page, specify the Rule Name and click Create Rule.
    Figure:  Add Rule Pop-up page

5. On the top menu, hover your mouse over Applications and select Applications.
    Figure:  Applications

6. On the Applications page, click Add Application and then click Create New App.
    Figure:  Add Application

7. On the Create New Application pop-up page, select the platform as Web and Sign On Method as OpenID Connect.
    Figure:  Create New App page

8. On the Create OpenID page, specify the Application Name and the Redirect URL.
    Figure:  Create OpenID page

Note:

The Redirect URL specified here should be entered in the Redirect URL field application.

1. On the General Settings Page, click Edit and select all the available options under Allowed grant types. The Client ID and Client Secret are displayed under Client Credentials section. Store them securely.
    
   Figure:  General Settings page

Note:

The Client ID and Client Secret displayed here should be entered in the Client Id and Client Secret Key fields of application.

1. You can add multiple People or Groups to the application under the Assignments section.
    
   Figure:  Add Assignment page

Configuration in application

To Configure SSO for Okta from Application, perform the following steps:

1. Navigate to Admin > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel.

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

For Mobile

Prerequisites to be performed in Okta Portal

Prerequisites to be performed in Okta Portal  

1. Sign up in Okta portal using https://www.okta.com/developer/signup/.
    
   Figure:  Sign up

2. Click Get Started. Your login URL is displayed. Login to Okta using this URL. You will receive a confirmation mail. Set your password by clicking this link.
    
   Figure:  Okta URL

3. Specify your User Name and Password and click Sign In.
    
   Figure:  Okta Login page

4. On the top menu, select Security > API.
    
   Figure:  Security Menu

5. On the API page, click Authorization Servers.
    
   Figure:  API Page

6. On the Add Authorization Server pop-up page, Specify Name, Audience, and Description. For more information about these fields, refer https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html.
    
   Figure:  Add Authorization URL Pop-up page

7. Under the Settings section, the issuer field is displayed. Store this URL securely.
    
   Figure: Settings section

Note:

The Issuer URL displayed here should be entered in the Authorization URL, Access Token URL, and User Info URL fields of application.

1. Select Access Policies and click Add Policy. The Add Policy pop-up page is displayed.
    
   Figure:  Add Policies pop-up page

2. On the Add Policy pop-up page, specify the Name, and Description and click Create Policy.
    
   Figure:  Add Policy page.

3. On the Add New Access Policy page, create Add Rule.
    
   Figure:  Add New Access Policy Page

4. On the Add Rule pop-up page, specify the Rule Name and click Create Rule.
    
   Figure:  Add Rule Pop-up page

5. On the top menu, hover your mouse over Applications and select Applications.
    
   Figure:  Applications

6. On the Applications page, click Add Application and then click Create New App.
    
   Figure:  Add Application

7. On the Create New Application pop-up page, select the platform as Web and Sign On Method as OpenID Connect.
    
   Figure:  Create New App page

8. On the Create OpenID page, specify the Application Name and the Redirect URL.
    
   Figure:  Create OpenID page

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

1. On the General Settings Page, click Edit and select all the available options under Allowed grant types. The Client ID and Client Secret are displayed under Client Credentials section. Store them securely.
    
   Figure:  General Settings page

Note:

The Client ID and Client Secret displayed here should be entered in the Client Id and Client Secret Key fields of application.

1. You can add multiple People or Groups to the application under the Assignments section.
    
   Figure:  Add Assignment page

Configuration in application

To Configure SSO for Okta from Apex, perform the following steps:

1. Select Admin > Basic > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel.

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

Ping Federate

To enable Single Sign on for Ping Federate from Apex, the following configuration should be done in Ping Federate portal.

Prerequisites to be performed in Ping Federate Portal

1. Login to Ping Federate server.
    Figure:  Login Screen
   

2. On the Server Configuration tab, click Server Settings.
    Figure:  Server Configuration
   

3. On the Server Settings page, configure the tabs as shown below:

System Administration

Figure:  System Administration tab 

System Info

Figure:  System Info tab 

Runtime Notifications

Figure:  Runtime Notifications tab

Runtime Reporting

Figure:  Runtime Reporting tab

Account Management

Figure:  Account Management tab

Roles & Protocols

Make sure that Enable OAUTH 2.0 Authorization Server (AS) Role is selected.

Figure:  Roles & Protocols tab

Federation Info

Figure:  Federation Info tab

System Options

Figure:  System Options tab

Metadata Signing

Figure:  Metadata Signing tab

Metadata Lifetime

 Figure:  Metadata Lifetime tab

Summary

Figure:  Summary tab 

1. On the Server Configuration page, click Data Stores.
    Figure:  Data Stores
   

2. On the Manage Data Stores page, click Add New Data Store.
    Figure:  Manage Data Stores
   

3. On the Data Store page, configure the tabs as shown below:

Data Store Type

Select the Data Store Type as LDAP.

Figure:  Data Store Type tab

LDAP Configuration

Provide your LDAP Credentials.

Figure:  LDAP Configuration tab

Summary

Figure:  Summary tab

1. On the Server Configuration page, click Active Directory Domains/Kerberos Realms.
   

2. On the Manage AD Domains/Kerberos Realms page, click Add Domain/Realm.
    Figure:  Add Domain/Realm

Note

To check the configuration, click Test Domain/Realm Connectivity. You should receive a Test Successful message if your configuration is correct.

1. On the Manage Domain/Realm page, Specify the Domain Name, Username and Password.
   Figure: Manage Domain/Realm page
   

2. On the Server Configuration page, click Password Credential Validators.
    Figure:  Password Credential Validators
   

3. On the Password Credential Validators page, click Create New Instance.
    Figure:  Create New Instance 
   

4. On the Create Credential Validator Instance, configure the tabs as shown below:

Type

Figure:  Type

Instance Configuration

Specify the Search Filter as (|(sAMAccountName=${username})(userPrincipalName=${username})) 

Figure:  Instance Configuration tab

Extended Contract

 Add sAMAccountName and userPrincipalName under Extend the Contract. 

Figure:  Extended Contract tab

Summary

Figure:  Summary

1. On the Identity Provider page, click Adapters.
    Figure:  Adapters
   

2. On the Manage IDP Adapter Instances page, click Create New Instance.
    Figure:  Manage IDP Adapter Instances
   

3. On the Create Adapter Instance page, configure the tabs as shown below:

Type

Select Type as HTML Form IdP Adapter.

Figure:  Adapter Type

IDP Adapter

Select Password Credential Validator Instance as Password Validator and click Update under Action.

 Figure:  IDP Adapter

Extended Contract

Under Extend the Contract add domainusername and email. 

Figure:  Extended Contract

Adapter Attributes

Figure:  Adapter Attributes

Adapter Contract Mapping

Figure:  Adapter Contract Mapping

Summary

Figure:  Summary 

1. On the OAuth Server page, click Create New under Clients.
    Figure:  OAuth Server page
   

2. On the Client page, configure the tabs as shown below:
    Figure:  Client page

Note

• Client ID: The Client ID you enter above should be entered in the Client ID field of application.

• Client Secret: The Client Secret generated above should be entered in the Client Secret Key field of application.

• Redirect URL: The Redirect URL you enter above should be entered in the Redirect URL field of application. Example: https://baseurl/Apex_Samlresponse.aspx for Web Application and https://baseurl/Apex_Weblogin.aspx for Mobile Application.

1. On the OAuth Server page, click Access Token Management under Token Mapping.
    Figure:  Access Token Management
   

2. On the Access Token Management page, click Create New Instance.
    Figure:  Create New Instance
   

3. On the Create Access Token Management Instance, configure the tabs as shown below:

Type

Select the Type as Internally Managed Reference Tokens.

 Figure:  Access Token Type

Instance Configuration

 Figure:  Instance Configuration

Session Validation

Figure:  Session Validation

Access Token Attribute Contract

Under Extend the Contract, add domainusername, email, group, username.

 Figure:  Access Token Attribute Contract

Resource URLs

Figure:  Resource URLs

Access Control

Figure:  Access Control

Summary

Figure:  Summary

1. On the OAuth Server page, click IDP Adapter Mapping.
    Figure:  IDP Adapter Mapping
   

2. On the IDP Adapter Mapping page, select HTML Form Adapter from the drop-down list and click Add Mapping. Click Save.
   
   Figure:  Add Mapping
   

3. The Summary page of IDP Adapter Mapping is displayed.
    Figure:  IDP Adapter Summary
   

4. On the OAuth Server page, click Access Token Mapping.
    Figure:  Access Token Mapping
   

5. On the Access Token Attribute Mapping page, select Context as HTML Form Adapter, Access Token Manager as actoken and click Add Mapping. Click Save.
    Figure:  Access Token Attribute Mapping
   

6. The Summary page of Access Token Attribute Mapping is displayed.
    Figure:  Summary
   

7. On the OAuth Server page, click Authorization Server Settings.
   
   Figure:  Authorization Server Settings
   

8. Configure the Authorization Server Settings page as shown below:
   Figure:  Authorization Server Settings
   

9. On the OAuth Server page, click Scope Management.
   Figure:  Scope Management
   

10. On the Common Scopes tab, add email under Scope Value.
    Figure:  Common Scopes
    

11. On the OAuth Server page, click OpenID Connect Policy Management.
    Figure:  OpenID Connect Policy Management
    

12. On the Policy Management page, click Add Policy.
    Figure:  Add Policy
    

13. On the Policy Management page, configure the tabs as shown below:

Prerequisites to be performed in Ping Federate Portal

Manage Policy

Figure:  Manage Policy

Attribute Contract

Figure:  Attribute Contract

Attribute Scopes

Figure:  Attribute Scopes

Attribute Sources & User Lookup

Figure:  Attribute Sources & User Lookup

Contract Fulfillment

Figure:  Contract Fulfillment

Issuance Criteria

Figure:  Issuance Criteria

Summary

Figure:  Summary

Configuration in application

To Configure SSO for Ping Federate from Apex, perform the following steps:

1. Select Admin > Infrastructure > SSO Configuration. The SSO Configuration page is displayed.

2. On the SSO Configuration page, select OAuth under the Authentication Type and click Add New on the Actions Panel.

3. Specify the required details and click Submit. For more details about the fields on the SSO Configuration page, see Field Description.

Field Description

The following table describes the fields on the SSO Configuration page:

Actions

This section explains all the icons displayed on the Actions panel of the SSO Configuration page.

SHOW LIST

Click SHOW LIST to display the LIST table showing all the SSO Configurations in the application for OAuth based authentications.

Filters

On the Filters pop-up page, select a domain name from the list and then click Submit. A list of OAuth based authentications configured for the selected domain is displayed.

Add New

Click Add New to configure a new OAuth based authentication for a domain.