Authorization Server

You need to create an OAuth server definition in AuthServer. It can be done using the management portal or using OAuth2.* classes.

For convenience, you will use an utility that is already prepared with some settings.

Open a terminal session:

docker exec -it authserver bash
iris session iris

Create the OAuth server definition with the utility which uses OAuth2.* classes:

zn "AUTHSERVER"
do ##class(auth.server.Utils).CreateServerConfig()

Have a look at the OAuth Server definition in System Administration > Security > OAuth 2.0 > Server and check:

Supported grant types

• These are the grant types that your auth server will support.
• There are different grant types suitable for different scenarios. For example, for a REST API you could use client credentials, and for web applications the authorization code.

Scopes

• A client can request one or more scopes. This information is displayed to the user in the consent screen.
• You can define your own scopes.
• Your auth server will also support OIDC scopes.

JWT Settings

• Algorithms used to sign and encrypt access token (JSON Web Token - JWT).

Customization

• You can customize the behaviour of your auth server.
• In this case, customizations will be done in AUTHSERVER namespace.
• auth.server.Authenticate can customize different methods like:
  • BeforeAuthenticate, AfterAuthenticate
  • DisplayLogin - customize login page that will be presented to users when authenticating
  • DisplayPermissions - customize consent page that will presented to users when consenting scopes
• auth.server.Validate also can customize methods like:
  • ValidateUser - this is actually how users are authenticated in the system. By default it authenticates based on users created on the InterSystems IRIS instance. However you can write any other behaviour you need.

After defining the server, a new /oauth2 web application has been created. The OpenID URL for the server is available at: https://webserver/authserver/oauth2/.well-known/openid-configuration

Client

You have now to register the client that will be able to ask for tokens and access the resource server.

• In AuthServer, go to System Administration > Security > OAuth 2.0 > Server > Client Descriptions
• Create a client description for our Postman client as follows.
• In the Client Credentials tab, copy Client ID and Client Secret values. You will use these values in Postman.