19.1 What is OAuth 2.0?

OAuth 2.0 (Open Authorization 2.0) is an industry-standard protocol for authorization that enables applications to obtain limited access to user accounts on an HTTP service. It works by delegating user authentication to the service that hosts the user account and authorizing third-party applications to access that user account. OAuth 2.0 provides specific authorization flows for different types of applications including web applications, desktop applications, mobile devices, and IoT devices. Unlike traditional authentication mechanisms where credentials are shared, OAuth 2.0 uses access tokens to grant access to protected resources.

19.2 What is OAuth 2.0 Used For?

OAuth 2.0 simplifies secure API access and service-to-service authentication by separating authentication from authorization. The key benefits include:

• Secure API Access: External systems can access protected endpoints without sharing credentials
• Token-Based Security: Short-lived access tokens reduce the risk of credential theft
• Flexible Integration: Supports multiple authentication flows for different use cases
• Non-Intrusive Implementation: Works alongside existing authentication mechanisms (JWT, SAML, LDAP)
• Role-Based Authorization: Identity providers can pass user roles and groups for fine-grained access control

19.3 How OAuth 2.0 Works

• Client Requests Access Token: The client application requests an access token from the authorization server (Okta)
• Authorization Server Authenticates: Okta verifies client credentials and issues an access token
• Client Accesses Protected Resource: The client includes the access token in API requests using the Authorization: Bearer <token> header
• Resource Server Validates Token: The application validates the token with Okta’s introspection endpoint
• User is Granted Access: Upon successful validation, the application grants access based on the token’s scope and groups

The Data Gateway application implements a dual-token validation system that supports both internal Users and external OAuth 2.0 Users irrespective of the security profile

19.4 Configuring OAuth 2.0 Authentication in Okta

19.4.1 Prerequisites

1. An active Okta account with administrative access
2. Administrative access to the Data Gateway application
3. Understanding of OAuth 2.0 grant types (Client Credentials flow recommended for API access)

19.4.2 Steps to Configure OAuth 2.0 in Okta

1. Create an OAuth 2.0 Application in Okta

• Log into your Okta Admin Console

• Navigate to Applications → Applications

• Click Create App Integration

• OIDC – OpenID Connect

• Click Next

2. Configure Application Settings

• Enter an Application name (e.g., “Data Gateway API”)
• Enter the call back URL to where the idp needs to send the rensponse containing the authorisation code

• Select appropriate Grant types:
  • Client Credentials (for machine-to-machine communication)
  • Authorization Code (for user-based authentication)
• Click Save

3. Note Client Credentials

After creation, Okta will display:

• Client ID: Unique identifier for your application
• Client Secret: Secret key for authentication (keep this secure)
• Okta Domain: Your Okta organization URL (e.g., https://dev-123456.okta.com)

Important: Copy the Client Secret immediately as it won’t be shown again.

4. Configure Authorization Server

• Navigate to Security → API → Authorization Servers
• Select the default authorization server or create a custom one
• Note the Issuer URI (e.g., https://dev-123456.okta.com/oauth2/default)
• Configure Scopes if needed for fine-grained access control

5. Create and Assign Groups

• Under Assignments, add the users or groups who should have access to the application.

•  Click on ‘Add Person’, provide the user details, and click on ‘Save’. The user will receive a ‘Set Password’ link if the ‘I will set password’ checkbox is selected.

• Create groups matching your application roles:
  • super_admin
  • admin
  • business_user

• Assign users to appropriate groups

• After successfully assigning the application to the user and user can be able to see assigned application like mentioned below

6. Configure Claims (Optional)

• In the Authorization Server, go to Claims tab
• Ensure the groups claim is included in access tokens

• Configure Access policies type as Groups with filter matching your group names

19.5 Application Configuration (application.yml)

The OAuth 2.0 configurations need to be provided in the Data Gateway application configuration: Now the user will be able to access the endpoint with the help of the access token issued by the OAuth 2.0 application configured in the respective IDP. If the IDP authentication is successful, we can find a access token in the response which can be used to access the application API’s.