5.14.6 Using Access Gateway in the OAuth Flow

The following diagram depicts the OAuth flow when using Access Gateway for protecting the APIs, injecting scopes, and retrieving the access token:

OAuth Implementation using Access Gateway

  1. Determine the web application or REST service for which you want to implement this configuration.

  2. Create a reverse proxy in Access Gateway and enable OAuth in Access Gateway for this reverse proxy. See Enabling OAuth in Access Gateway.

  3. Configure an authorization policy based on OAuth Scopes. See Configuring an Authorization Policy based on OAuth Scopes.

  4. Configure an Identity Injection policy to inject user name and password. See Configuring an Identity Injection Policy for OAuth Claims.

  5. Configure optional Identity Injection policies to inject other user claims, if required. You can define the additional roles in the same policy also that you configured for injecting user name and password. See Configuring an Identity Injection Policy for OAuth Claims.

  6. Apply the changes.

For information about how to configure OAuth in Access Manager for this implementation flow, see Configuring Access Gateway for OAuth.