REST API oAuth2.0

[Jorge Cruz]

Hello,

Brief Description: Enable Micro Focus Operations Orchestration to leverage oAuth2.0 to authenticate against REST API.

Benefits/Value: 

• oAuth2.0 provides a much stronger authentication /authorization model then Basic Auth
• If a token gets compromised under oAuth2.0 and that tokens time to live is only set to a hour. The attacker has a limit window with that token. Unlike Basic Auth, the token (Base64) continues to be valid until the password is changed

Design details:

• Have the ability to leverage cutomers identity provider, in our example Azure Active Directory

[FlorinM]

This is a very good idea. Thank you for posting it!

Changing status to Waiting for Votes to get community support.

[benwatt]

Voted this up. I had to abandon the out of the box HTTP Client options because of this, and use Powershell for REST API calls instead.

[Lucian-Revnic]

Hi Benwatt,

From the description and tag of the idea it looks like the enhancement is for OO REST API. 

From your comment above I understand you need enhancements in the HTTP Client OOTB operations as well? Can you detail a bit on this? Have you submitted any idea on the out of the box operations as well?

Thank you,

Lucian

[asish]

Hi Team,

We also , under a different project required OO application to leverage with OuthV2 authentication.

We have been updated to refer this ER  over Support ticket  SD02538439 raised for the feasibility of OuthV2.

We have an Incident flow setup with Service now and as per Company standards, all rest API integrations to configured with Outh V2, so to meet the standards, we need OO to support Outh V2 as well. Failing this , our OO application and existing integration will be marked as Non Complaint.

So expecting a quick review on this to have this prioritize.

Br,

Ashish Banyal

[daniel_crisan]

Hi Ashish, 

Oauth2 protocol can be implemented in many different ways by the identity providers. Can you tell us what IDP do you use for your Oauth2? 

Regards,

Daniel

[FlorinM]

The support for OAuth2 on the REST APIs is in plan and will e delivered in a future release.

[Jorge Cruz]

@daniel_crisan the identity provider that we are looking at is AAD (Azure Active Directory)