Credential Injection OAuth 2.0 Policy

Policy Name

Credential Injection OAuth 2.0

Summary

Injects an OAuth 2.0 authorization header into outgoing requests

Category

Security

First Flex Gateway version available

v1.9.0

Returned Status Codes

No return codes exist for this policy. Error codes are returned from the upstream service.

Summary

The Credential Injection OAuth 2.0 policy injects an Authorization token from an OAuth 2.0 service into a request as a header. You can use any third-party OAuth 2.0 Identify Provider (IdP), such as Okta, AWS, Azure, or Google Cloud Platform. The policy allows for tokens based on the OAuth 2.0 Authorization Framework to be injected into requests without having to register an external IdP server in Anypoint Platform.

Configuring Policy Parameters

Flex Gateway Local Mode

In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the following policy definition and table of parameters:

- policyRef:
    name: credential-injection-oauth2-flex
  config:
    oauthService: <string> // REQUIRED
    clientId: <string> // REQUIRED
    clientSecret: <string> // REQUIRED
    scope:
      - <string> // OPTIONAL
    overwrite: <boolean> // OPTIONAL
    tokenFetchTimeout: <number> // OPTIONAL
    allowRequestWithoutCredential: <boolean> // OPTIONAL

Parameter Required or Optional Default Value Description

Parameter	Required or Optional	Default Value	Description
`oauthService`	Required	`https://oauth-server/tokens`	URL of the OAuth 2.0 service.
`clientId`	Required	N/A	Client ID.
`clientSecret`	Required	N/A	Client Secret.
`scope`	Optional	N/A	Scopes to include in the token.
`overwrite`	Optional	`true`	When enabled, the policy overwrites the `Authorization` header with a new authorization token if the header is present.
`tokenFetchTimeout`	Required	10	Time in seconds to wait for the service to return the token.
`allowRequestWithoutCredential`	Required	`false`	When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.

oauthService

Required

https://oauth-server/tokens

URL of the OAuth 2.0 service.

clientId

Required

N/A

Client ID.

clientSecret

Required

N/A

Client Secret.

scope

Optional

N/A

Scopes to include in the token.

overwrite

Optional

true

When enabled, the policy overwrites the Authorization header with a new authorization token if the header is present.

tokenFetchTimeout

Required

Time in seconds to wait for the service to return the token.

allowRequestWithoutCredential

Required

false

When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.

Resource Configuration Example

- policyRef:
    name: credential-injection-oauth2-flex
  config:
    oauthService: <https://oauth-server/tokens>
    clientId: id
    clientSecret: secret
    scope:
      - user
    tokenFetchTimeout: 20
    allowRequestWithoutCredential: true

Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy to your API instance from the UI, the following parameters are displayed:

Parameter Description Required?

Parameter	Description	Required?
OAuth 2.0 service URL	URL of the OAuth 2.0 service.	Required
Client ID	Client ID.	Required
Client secret	Client Secret.	Required
Scope	Scopes to include in the token.	Optional
Overwrite header	When enabled, the policy overwrites the `Authorization` header with a new authorization token if the header is present.	Required
Token fetch timeout	Time in seconds to wait for the service to return the token.	Required
Allow request without credential	When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.	Required

OAuth 2.0 service URL

URL of the OAuth 2.0 service.

Required

Client ID

Client ID.

Required

Client secret

Client Secret.

Required

Scope

Scopes to include in the token.

Optional

Overwrite header

When enabled, the policy overwrites the Authorization header with a new authorization token if the header is present.

Required

Token fetch timeout

Time in seconds to wait for the service to return the token.

Required

Allow request without credential

When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.

Required