Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

This section describes the different properties that are in use in the Authorization Server. These properties are divided into several blocks with each block corresponding to a particular element of the Authorization Server.

Authorization Server template.conf
jwt {
    key-id=jwt
    key-password="DR_DEFAULT_KEY-25FB75239B53E487605912194E971790"
    keystore-location="/path/to/keystore"
    keystore-password="DR_DEFAULT_KEY-25FB75239B53E487605912194E971790"
    # Only RS256, RS384 and RS512 are supported
    signature-algorithm=RS256
}
management-api {
    # Management Web API Base URI
    base-uri="/api"
    enable-basic-auth=false
    # HTTP Basic Authentication Password
    password="DR_DEFAULT_KEY-1D2E6A059AF8120841E62C87CFDB3FF4"
    # HTTP Basic Authentication Username
    username=mzadmin
}
sc=sc1
server {
    # Validity period in seconds for access token generated
    access-token-expiry=1800
    # Endpoint to request for access token
    access-token-uri="/token"
    host=localhost
    port=10000
}
storage {
    database {
        # Only used when storage type is "database". PostgreSQL or Oracle DB only
        profile-name="<Path.DBProfileName>"
    }
    file-based {
        # Only used when storage type is "file-based"
        storage-location="/path/to/file/storage"
    }
    # The storage type can be either "file-based" or "database"
    type=file-based
}
tls {
    enable-tls=false
    enable-two-way-authentication=false
    # Configure keystore if using TLS
    keystore-location="/path/to/keystore"
    keystore-password="DR_DEFAULT_KEY-25FB75239B53E487605912194E971790"
    # Configure truststore if using TLS 2-way authentication
    truststore-location="/path/to/truststore"
    truststore-password="DR_DEFAULT_KEY-25FB75239B53E487605912194E971790"
}


JWT

The Authorization Server generates JSON Web Token (JWT) based access token and requires the JWT to be digitally signed. Currently, only the RSA private/public key pair signing method is supported.

The JWT block is used to configure the keystore and the RSA private/public key pair details.

Parameter NameDescription
keystore-location
Path to the keystore where the RSA private/public key pair used for JWT is stored. Only Java KeyStore (JKS) format is supported.
keystore-password
Password of the keystore. Must be encrypted using "mzsh encryptpassword" command
key-id
Alias of the RSA private/public key pair used for JWT
key-password
Password of the RSA private/public key pair used for JWT
signature-algorithm
Signature algorithm to be used for JWT sigining. Only RS256, RS384 and RS512 are supported


Management API

The Management API is used to provision scopes and register clients via HTTP. Clients need to be registered before any access token can be requested.

The Management API configuration is used to configure the base endpoint in the Authorization Server that will be used to host the Management API.

For more information on the function of the Management API, refer to Management API

Parameter NameDescription
base-uri
Base URI to host the Management API
enable-basic-auth

Enable HTTP Basic Authentication for Management API

It is recommended to have enable-basic-auth set to true. This is so the list of clients and scope will not be accessible to anyone without the proper credentials mentioned below.

username
Username for HTTP Basic Authentication (if enabled)
password
Password for HTTP Basic Authentication (if enabled). Must be encrypted using "mzsh encryptpassword" command


SC

The Authorization Server will be hosted in a Service Context (SC) and the name of the SC needs to be specified.

Parameter NameDescription
sc
Name of the Service Context (SC) that will be hosting the Authorization Server.


Server

The server configuration for the OAuth2 Service that will determine where the access token endpoint will be hosted on and the access token expiry.

Parameter NameDescription
host
Hostname or IP address to host the OAuth2 Service. This should match with the SC hostname or IP address
port
Port number to host the OAuth2 Service
access-token-uri
URI for the access token endpoint. Access token will be requested here
access-token-expiry
Validity period in seconds for access token generated


Storage

The OAuth2 Service can store provisioned scopes and registered clients into memory or persistent storage.

The storage configuration is used to determine where the data should be stored. For Database type storage, please see Authorization Server Storage Database Schema for more details on how to create the table for the Authorization server.

Parameter NameDescription
type

Type of storage to be used. The value can be one of the following:

file-based (Default) - The data will be stored in a file-based storage

database - The data will be stored in a database.

Only PostgreSQL and Oracle database are currently supported.

file-based.storage-location

Location of the file-based storage. Will be created if not found. Only used when storage type is set to "file-based"

For fresh installs, the last path in the location should be non-existent as the Authorization server will create it automatically.

database.profile-name

The Database Profile Name in MZ to be used. Only used when storage type is set to "database". The value of the profile name should include the directory name as shown in the desktop UI.

Example

storage {
	database {
			profile-name="REST.PRF_DB"
	}
	type="database"
}


TLS

The Authorization Server runs on the HTTP protocol and it is highly recommended that the HTTP protocol is secured using TLS.

The TLS configuration is used to configure TLS settings in order to setup the HTTPS protocol.

Parameter NameDescription
enable-tls
Enable TLS for HTTP protocol (HTTPS)
keystore-location
Path to the keystore where the private/public key pair used for OAuth2 Service is stored. Only Java KeyStore (JKS) format is supported.
keystore-password
Password of the keystore. Must be encrypted using "mzsh encryptpassword" command
enable-two-way-authentication
Enable TLS 2-way (mutual) authentication
truststore-location
Path to the truststore where the client certificates are stored. Only Java KeyStore (JKS) format is supported.
truststore-password
Password of the truststore. Must be encrypted using "mzsh encryptpassword" command


  • No labels