Configuring an Authorization Policy based on OAuth Scopes

You must configure an authorization policy and then assign it to the protected resource. Access Gateway makes decisions based on the rules defined in the authorization policy after validating the OAuth tokens.

Resources protected by OAuth tokens do not execute any authentication procedure. Hence, evaluation of policies associated with OAuth protected resources cannot fetch any user attributes outside the OAuth scope. All the user attributes needed for the protected resource must be part of the OAuth scope. Ensure that the proxy services protected by OAuth are not associated with any policies that refer to authentication contract, profiles, LDAP attribute, LDAP OU, roles, or RISK score. Any policy, which requests for data other than the scope of OAuth token fails.

Perform the following steps to configure an Authorization policy for scopes:

  1. Click Devices > Access Gateway > Edit > [Reverse Proxy name] > [Proxy Service name].

  2. Select the Protected Resources tab.

  3. Click the protected resource for which you want to configure an Authorization policy.

  4. Select the Authorization tab.

  5. Click Manage Policies > New.

  6. Specify a name for the policy and select Access Gateway: Authorization for the policy type.

  7. Click OK.

  8. Specify the following details:

    Field

    Action

    Description

    (Optional) Describe the purpose of this rule.

    Priority

    Specify the order in which a rule is applied in the policy, when the policy has multiple rules. The highest priority is 1 and the lowest priority is 10.

    NOTE:If two rules have the same priority, a Deny rule is applied before a Permit rule.

    Conditions

    Click New and then select OAuth Scopes.

    For Value, select the scope from the list.

    Actions

    Select one of the following options:

    • Permit: Allows the user to access the resource.

    • Deny: Select one of the following deny actions:

      • Display Default Deny Page: Displays a generic message, indicating that the user has insufficient rights to access the resource.

      • Deny Message: Allows you to provide a customized message that you want to display to users after denying their access attempts.

      • Redirect to URL: Allows you to specify a URL to redirect users after denying access. For example: http://www.example.com

    • Redirect: Specify the URL to which you want the users to redirect when they meet the conditions of this policy.

    • Re-authenticate with Contract: Allows you to specify an authentication contract used to authenticate the user.

  9. Click OK > OK.

  10. Select the policy you created and click Apply Changes > Close.

  11. Select the Authorization policy and click Enable > OK.