OAuth integration enhancements
The following are the enhancements to OAuth integration.
Indicate if an OAuth Server is disabled and why
If access tokens for an OAuth server are not refreshed, the OAuth Server is disabled and the import sources and web service activities leveraging the OAuth Server no longer work.
The new Disabled reason setting in the OAuth Server configuration indicates whether the OAuth Server is disabled. The reason why it is disabled is also displayed.
TotalAgility OAuth clients
TotalAgility RESTful SDK APIs support OAuth client credentials flow as an authentication type. You can configure different OAuth calling "applications" where each has its own client ID and client secret. See TotalAgility OAuth clients in the TotalAgility Designer Help.
In addition, the following functionality is also supported:
OAuth authentication using third-party OAuth providers
In Tungsten TotalAgility 8.0.0, the access tokens that can be used for TotalAgility REST SDK APIs were generated by TotalAgility. The clients were also defined and authenticated within TotalAgility.
Tungsten TotalAgility 8.1.0 also supports access tokens from authorized third-party providers. The clients can be defined and authenticated by third-party providers once you specify in TotalAgility Designer which third-party providers are authorized, along with relevant details to validate the access tokens.
Only third-party OAuth providers that use JWT access tokens are supported.
Client assertions for OAuth clients
Tungsten TotalAgility 8.0.0 supported "secret in post body or basic authentication."
In Tungsten TotalAgility 8.1.0, you can enable support for OAuth client assertion in OAuth Client configuration for REST SDK APIs in TotalAgility Designer.
When the "Client assertion" authentication method is selected, client assertion is sent to the OAuth token endpoint (OAuth/token) that extracts and validates it using the new client assertion fields (Audience, Issuer, Subject, and signature) before issuing the access token.
Specific user for each OAuth client application
In Tungsten TotalAgility 8.0.0, all OAuth client applications are identified with the System session ID.
In Tungsten TotalAgility 8.1.0, when using OAuth authentication with TotalAgility REST SDK APIs, you can specify (optionally) a TotalAgility user in the TotalAgility OAuth client configuration. This user is identified as the calling user when an access token granted for the OAuth client app is in use.
Extra authentication using client certificates when using OAuth clients
When defining OAuth clients to use with TotalAgility OAuth authentication, you can specify one or more client certificates (mTLS) to be allowed as extra authentication to call the TotalAgility REST SDK APIs. Subsequently, the OAuth access token generated by TotalAgility can call the REST SDK APIs when a matching client certificate is passed.