APM: OAUTH2 JWT Token with groups claim
Hello and happy new year 😉 We use APM as OAuth Authorization Server to create JWT token for apps. One of our customers wants to use the MicroProfile JWT(MP-JWT) for his application, that needs some specific claims: https://github.com/eclipse/microprofile-jwt-auth/blob/master/spec/src/main/asciidoc/interoperability.asciidoc One requirement is to encode the groups claim in JSON array: "groups": ["red-group", "green-group", "admin-group", "admin"] We now try to set the claim with groups from the Active Directory. With an iRule, I filtered the AD groups (from memberOf) and set a new APM variable (session.custom.groups) with this value: ["red-group", "green-group", "admin-group", "admin"] When I now add a claim groups with %{session.custom.groups} as value, I see that string in my JWT token: "groups": "[\"red-group\", \"green-group\", \"admin-group\", \"admin\"]" So the value is escaped and has is in quotation marks. Is there any chance to send claims as JSON array? Any help would be appreciated.Request and validate OAuth / OIDC tokens with APM
BIG-IP APM is able to request and validate OAuth2.0 and OpenID Connect tokens. It can act as Client, Resource Server and Authorization Server. In this article, I cover the use cases where APM acts as Resource Server (validating the tokens) and Client (requesting the tokens). 1. The tokens : Access Token: this is the Oauth2.0 token (access_token). It is used for Authorization and has to bevalidated by the Resource server. This Resource Server will contact the Authorization server for validation (Out of Path validation - External) Access Token can be either OPAQUE or JWT ID Token: this is the OpenID Token (id_token).It is used by the client onlyin order to know you use the resource owner. For instance, when you see you name and your picture on the top right corner of an app, this comes from the ID_Token. This token is not user/validated by the Resource Server ID Token is JWT only 2. OPAQUE vs JWT tokens : JWT: Decodable Encryptable Can be validated against a preconfigured JWKS in-box or externally OPAQUE: Not decodable (opaque) Proprietary format, might be any length, and must be unique Must be validated in out-of-path HTTP request to the originating provider (the Authorization Server) 3. Token validation : OAuth Scope agentis used to validate anAccess Token either against aninternalJSON web key set (JWKS) if the Access Token isJWTvia an APM provider configuration (Azure AD uses JWT only) orexternallyvia HTTPS if the Access Token isOpaque. JWKS is faster because we don't have an extra HTTP transaction. Oauth Scope agentis used when APM is RS and the request from the client (APM or mobile app) has a authorization bearer header. Either with Opaque (External)or JWT token (Internal). With Opaque token, if the RS needs more information about the user, it needs to request anOpenID Connect UserInfoby presenting theaccess_token to the AS. The opaque scope provides with several information but it depends of the AS. For Google, an OIDC userInfo is needed to get the First and Last names. 4. Token Request : Oauth Client agentis used to request theAccess token and id_tokenwhen APM is deployed asOauth Client. To do so, 2 grant types are available (Code and password) WithAuthorization code grant, the Client agentexchangesan Authorization code for an access_token code + id_token (if OIDC used). When the Oauth Client gets the access_token (and id_token), theOauth scope agent validatesthem.
Oauth 2.0 grant type for machine to machine
Since it looks like APM doesn't support the client credentials grant type, I'm curious what grant type folks are using for machine to machine communication. We make API calls to endpoints that don't have a UI where a user would enter any credentials since there isn't a user involved in these types of calls. Thanks, Scott
Using OAuth2 to share access for 2 DataCenters
Hello. I have two datacenters which serve the same app, masked by one APM device for authentication (using SSO to the backend) for each DC. When one DataCenter is down, all users that were using this DC start using the backup DC, but they have to authenticate again. I was searching ideas to avoid this (re-auth). One idea is to use OAuth2 with an external Authorization Server(shared by both DC). But checking deployment guides, I have seen all alternatives are using a logon page as initial step for initiation. I think the solution doesn't fix my initial requirement (avoid re-authentication when my users are moving from one DC to another). Please, could you confirm if I could avoid the reauthentication step using OAuth2? Any other ideas to get my requirement? References: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-sso-13-1-0/37.html https://clouddocs.f5.com/training/community/iam/html/class2/class2.html KR, Dario.
Redirect-URI does not match with client app configuration
In the Access >>Federation : OAuthorization Server : Client Application, We need to add the «Redirect URI(s)», but our client app redirect uri has a variable query string, the session ID. Like the session ID is different for each user, I can't put it in the F5 OAuth client app configuration. So, if I dont put the query string, I receive this error: "Redirect-URI ( https://...) does not match with client app configuration" What can I do? Does it exist wildcard options?F5 APM as OAuth Authorization server and Resource server
I’m using F5 as both Authorization server and Resource server. Haven’t setup client server yet so it accepts any username and any password. When testing in postman, I can generate token and pass them via request header but when submitting the GET request I’m seeing 503 DNS resolver error in the response headers. Please help.
APM policy with external logon page for authorization server
Hi All, we are Using APM as an authorization server and an external logon page has been configured in the access policy. The external logon page is configured to capture the credentials and then posts it back to /my.policy as Ajax call (for a better user experience). the problem is the response from the AS. it redirects to the resource, for example: https://resource.example.com/oauth/client/redirect?error=access_denied&state=5x8IL https://resource.example.com/oauth/client/redirect?code=89d016e1c70140c52441bf5aad&state=5DqyFME-D I tried to change the response by irule events and http::respond to 200 OK/ 401 unauthorized but it`s not working. Any ideas? Thanks for your assistance in advance.Big-IP v13.0.0 OAuth architecture
Can someone explain how OAuth works in F5? I know there are some articles on support site which is great, but i'm trying to understand the flow how each component communicate. (OAuth authorization Server, OAuth Client, OAuth Resource server etc) Basically i'm confused around the configuration pieces of each component. A scenario would help lot of people out there.. Any help is greatly appreciated! Thanks in advance!
