Layer7 API Management

Hi There,

I'm using the grant_type password and authenticating against internal identity provider looking to have user first name and LastName in the response besides the outbox.Pls, advice how could I can accommodate it?

 In fact tried but getting following error. How to get around it?

Hello!

Currently you can only add details in the token API itself, /auth/oauth/v2/token. In the same branch that handles 'OTK grant_type=PASSWORD', the assertion 'OTK User Attribute Look Up' could be introduced, attributed extracted and added to the response message.

The other option is to overwrite the default implementation for the grant_type. Use the policy for a custom grant_type and disable the original branch.

I hope this helps!

Hi Sascha Preibisch,
Are you asking to use granttype to custom rather password to have custom attributes?
Actually the requirment is to use the grant_type=password(Resourceownerpassword credentilaw). Pls advice could not get your second approch.Am using gateway 9.1 version
since am using password
grant_type=password&username=admin&password=testpwd@1&client_id=a37baf76-7c59-4a15-a859-b36b6578f2e0&client_secret=8985d436-4117-4094-8134-034b0b2dca87&scope=authorized&redirect_uri=https://callback.com/

Popleys

Hi!

I only meant that you could use the custom grant_type policy, but without introducing a custom grant_type! It may sounds confusing, I must admit.

You would handle 'grant_type=password' but simply disable the default implementation for it. This means, the client does not need to change anything, you only modify the server.

If this is still confusing I can provide an example.

Best regards!

P.S.: pls do not share client details in this forum unless they are purely for testing and not usable outside a test system!

Thanks for response.Could you pls provide an example for it.Arent you asking to perform following,disable existing grant_type=password and change grant_type=custom to password?

Good afternoon,

To add to what Sascha added on how to implement this. You will need to do the following:

1) Copy the OTK grant type=Password policy located under the OTK/Policy Fragments/grant_types folder to the OTK/Customizations/grant_types folder with a name like OTK grant type=Password Custom

2) Clone the OTK grant_type=Password encapsulated assertion to the new name OTK grant type=Password Custom

3) Update the auth/oauth/v2/token policy so that the OTK grant type=Password is comment out and you add in the new encapsulated assertion OTK grant type=Password Custom

4) Update the OTK User Attribute Look Up Extension policy to send back all the information that you need as it will be pulled back through the OTK User Authentication assertion 

as the variable ${current.user.attributes} in XML format

5) Modify the OTK grant type=Password Custom policy to return back the token by modifying the context variable clientResponse with values pulled from the XML

Sample Policy attached

Sincerely,

Stephen Hughes

Broadcom Support