Description

According to the RFC 6749 an application (client) owns the credentials and uses them to get an access token from the Authorization Server.

Authentication happens in a single request-response conversation when the request contains client credentials, grant_type (client_credentials) and optionally scope.

The response contains an access token, its type and expiration. Refresh token should not be included.

There are two main use cases for Client Credentials Grant in SSO:

• Single application use case: token grants access to the application itself;

• Authorized access use case: token grants access to a number of server applications according to the service user rights (group membership, authentication method allowed for service user account).

Single application use case

Description

In a single application use case a token grants access to only application itself. There is no authorization for this case.

Configuration

Client Credentials Grant can be configured either with SSO Management UI or SSO Management API. This instruction covers the UI. Refer to Configuring impersonation with Management API - SSO for API instructions.

Prerequisites:

1. Site Example, OAuth 2.0 application Client1 and group Group1 exist in SSO.

2. Application Client1 has client_credentials grant type in its metadata:

   ...
    "grant_types": [
       "client_credentials"
     ]
   ...

The following steps are required:

1. Create and enable authentication method as described in OAuth 2.0 Client Credentials Grant authentication method - SSO

2. Add this method to site Example.

3. Allow the method for application Client1

4. Allow the method for group Group1.

5. Allow Group1 to access application Client1.

Now it should be possible to get the token with Client1 credentials:

POST {{baseUrl}}/uas/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=oidc&client_id=client.credentials.app&client_secret=secret

Authorized access use case

In authorized access use case a token issued with client credentials of one application (Client) can grant access to other applications (Server1…ServerN). Authorization is based on access rights of impersonated user (Service user account).

For example when a Client is a command line script, Server1 is SSO Management API and Server2 is CustomerID API.

The configuration with 2 server applications shown below.

The Client application is impersonating a Service user account which is a member of 2 Groups. Each of these groups has access to one server application that should be accessed by the Client application. Authorization policies that can be configured for server applications omitted from the configuration example as it is not mandatory.