Skip to content

Latest commit

 

History

History
37 lines (18 loc) · 2.04 KB

configure-oauth-certificate-authentication-a40a3f3.md

File metadata and controls

37 lines (18 loc) · 2.04 KB

Configure OAuth Certificate Authentication

You can use outbound certificates generated by Identity Provisioning for OAuth authentication with provisioning systems.

In OAuth certificate authentication, Identity Provisioning acts as a client application that sends requests to the URL of the access token provider service (the authorization server). The server issues access tokens following a successful authentication with certificate (instead of using client ID and client secret).

Note:

Currently, OAuth certificate authentication is supported for SAP Build Work Zone, advanced edition, SAP CPQ, SAP Business Network and Procurement Data Warehous.

To configure OAuth certificate authentication for communication between Identity Provisioning and a given provisioning system, proceed as follows:

  1. Select the Properties tab of the provisioning system and make sure the Authentication property is set to ClientCertificateAuthentication.

    Note:

    This authentication method can only be configured using properties. It doesn't work with destinations.

  2. Add the OAuth2TokenServiceURL property and provide the URL of the access token provider service for your provisioning system.

  3. Add the client_id property and provide the OAuth Client id used for access token retrieval.

  4. Select the Certificates tab and generate the certificate for outbound connection, as described in Generate and Manage Certificates for Outbound Connection.

  5. Log in to the provisioning system and upload the certificate. The specific location may vary depending on the system, but it is typically found in the security or certificate management section.

  6. Run a provisioning job.

Results

During the job execution, Identity Provisioning authenticates to the authorization server using the client certificate and gets the access token issued by the server.