Introduction

Like all SOAJS microservices, OAuth microservice has different layers of configuration. Local configuration, tenant-level configuration if the microservice is a multitenant one, and registry configuration. Moreover, OAuth can have a custom separate database for tokens and users. 

Configuration Layers

1 - Tenant configuration

Provisioning is a configuration that all SOAJS micro-services can acquire once you turn on multi-tenant for them. Once a service becomes multi-tenant, you can provide custom tenant configuration to it at run time. If you have 2 tenants that can access the oAuth service, then the provisioned configuration for each tenant will be loaded once that tenant invokes an API in oAuth.

The below configuration is supported by the oAuth micro-service and can be configured & changed at the tenant level under the Manage Pillar.

{
    _id: "%tenant_id%",
    ...
    oauth: {
        secret: "tenant_oauth_secret",
        pin: {
            "%product_name%": {
                enabled: true
            }
        },
        disabled: 0, //OAuth enabled or not
        type: 2,//OAuth type
        loginMode: "%login_mode%"
    },
    ....
}

Follow the Configuration Steps to add and update tenant configuration for OAuth

You can change the values of the below variables to customize secret, type, and loginMode

2 - Environment configuration (registry)

This configuration is on the environment level. OAuth configuration can be added from SOAJS Console.

{
	_id: "%environment_id%",
	services: {
		...
		config: {
			...
			oauth: {
				grants: [
					"password",
					"refresh_token"
				],
				debug: false,
				getUserFromToken: true,
				accessTokenLifetime: 7200),
				refreshTokenLifetime: 1209600
			},
			...
		}
	}
}

Follow the Configuration Steps to add and update environment configuration for OAuth

You can change the values of the below variables to customize grants, debug, getUserFromToken, accessTokenLifetime, and refreshTokenLifetime

3 - Custom registry configuration

SOAJS oAuth supports pin login.

So what is is pin login? think of it as a fast way to login by entering a code without the need to enter the complete login information each time aka (email and password).

When is this useful? this is useful in many cases, for example in the hospitality business you might want to turn on pin login so employee can easily key in a code and quickly access the system.

Can i control the code length and type? yes check out SOAJS URAC pin configuration 

4 - Separate Database for tokens and users

OAuth can have a separate database that can be added from Deploy tab in SOAJS Console → Databases

Follow the Configuration Steps below to create a database for OAuth

The database should have the name "oauth" to be used.

5 - Tenant Key Configuration (provision)

oauth: {
	loginMode: "urac", //oauth login mode,
	roaming: {
		whitelistips: [
			"192.168.0.1",
			"127.0.0.1"
		]
	},
	passportLogin: { // 3rd party integrations using passport
	    "github": {...},
		"facebook": {...},
		"twitter": {...},
		"google": {...},
	},
	azure: {...},
	openam: {...},
	ldapServer: {...}
}               

Follow the Configuration Steps to add and update the key configuration for OAuth

You can change the values of the below variables to customize loginMode and passportLogin

Useful Links

Passport Login: Define application keys for passport integration. Currently supporting Github, Twitter, Facebook, and Google. Go to the link for more information and an example of the configuration.

/wiki/spaces/OAUT/pages/1433927681: Azure Active Directory Authentication Libraries allow the integration with Azure AD.

OpenAM login: SSO (Single Sign-On).

LDAP (Lightweight Directory Access Protocol) login: Active directory login.