Authorization Server Properties(4.0)

This section describes the different properties that are in use in the Authorization Server. These properties are divided into several blocks with each block corresponding to a particular element of the Authorization Server.

The authorization-server.properfies file, located at /opt/mz/etc/authorization-server, is automatically generated after executing the "Bootstrapping Authorization Server Credentials and Secrets" process. It is a read-only file, and any attempts to edit it are not recommended.

Authorization Server

enabled=false

# --------------------------------------------------------------------------------
# Storage Properties
# --------------------------------------------------------------------------------
# Only used when storage type is "database". PostgreSQL or Oracle DB only
storage.database.profile-name=<Path.DBProfileName>
storage.database.poolsize=8
# Only used when storage type is "file-based"
storage.file-based.storage-location=/path/to/file/storage
# The storage type can be either "file-based" or "database"
storage.type=file-based

# --------------------------------------------------------------------------------
# Server Properties
# --------------------------------------------------------------------------------
# Validity period in seconds for access token generated
server.access-token-expiry=1800

# --------------------------------------------------------------------------------
# Management Api Properties
# --------------------------------------------------------------------------------
management-api.enable-basic-auth=true
# HTTP Basic Authentication Password
management-api.password=<password>
# HTTP Basic Authentication Username
management-api.username=<

# --------------------------------------------------------------------------------
# JSON Web Token (JWT) Properties
# --------------------------------------------------------------------------------
jwt.key-id=jwt
jwt.key-password=<password>
jwt.keystore-location=/path/to/keystore
jwt.keystore-password=<password>
# Only RS256, RS384 and RS512 are supported
jwt.signature-algorithm=RS256

Storage

The OAuth2 Service can store provisioned scopes and registered clients into memory or persistent storage.

The storage configuration is used to determine where the data should be stored. For Database type storage, please see Authorization Server Storage Database Schema(4.0) for more details on how to create the table for the Authorization server.

Parameter Name	Description
type	Type of storage to be used. The value can be one of the following: file-based (Default) - The data will be stored in a file-based storage database - The data will be stored in a database. Only PostgreSQL and Oracle database are currently supported.
file-based.storage-location	Location of the file-based storage. Will be created if not found. Only used when storage type is set to "file-based" For fresh installs, the last path in the location should be non-existent as the Authorization server will create it automatically.
database.profile-name	The Database Profile Name in MZ to be used. Only used when storage type is set to "database". The value of the profile name should include the directory name as shown in the desktop UI. Example storage.database.profile-name=REST.PRF_DB
database.poolsize	The size of the connection pool, representing the number of database connections that are kept open and ready for use. Only used when stroage type is set to "database".

Server

The server configuration for the OAuth2 Service that will determine where the access token endpoint will be hosted on and the access token expiry.

Parameter Name	Description
access-token-expiry	Validity period in seconds for access token generated

Management API

The Management API is used to provision scopes and register clients via HTTP. Clients need to be registered before any access token can be requested.

The Management API configuration is used to configure the base endpoint in the Authorization Server that will be used to host the Management API.

For more information on the function of the Management API, refer to Management API

Parameter Name	Description
enable-basic-auth	Enable HTTP Basic Authentication for Management API It is recommended to have `enable-basic-auth` set to true. This is so the list of clients and scope will not be accessible to anyone without the proper credentials mentioned below.
username	Username for HTTP Basic Authentication (if enabled)
password	Password for HTTP Basic Authentication (if enabled). Must be encrypted using "mzsh encryptpassword" command

JWT

The Authorization Server generates JSON Web Token (JWT) based access token and requires the JWT to be digitally signed. Currently, only the RSA private/public key pair signing method is supported.

The JWT block is used to configure the keystore and the RSA private/public key pair details.

Parameter Name	Description
keystore	JWT keystore that facilitates the secure handling of cryptographic keys for JWT operations.
keystore-password	Password of the keystore.
key-id	Alias of the RSA private/public key pair used for JWT
key-password	Password of the RSA private/public key pair used for JWT
signature-algorithm	Signature algorithm to be used for JWT sigining. Only RS256, RS384 and RS512 are supported