Skip to Content

Okta 2-legged OAuth 2.0 API security profile in Jitterbit API Manager

Introduction

Within a security profile, you can configure Okta as an OAuth 2.0 identity provider to provide API consumers access to an API using Okta authentication.

This page shows how to configure and use Okta 2-legged authentication with a Jitterbit custom, OData, or proxy API by following these steps:

  1. Configure Okta as an identity provider
    Configure the Okta instance as an identity provider and obtain the Okta Audience and Scope to use as input for configuring a security profile in API Manager.
  2. Configure a security profile in API Manager
    Configure Okta as the identity provider in API Manager.
  3. Assign a security profile in API Manager
    Assign the security profile to one or more Jitterbit custom, OData, or proxy APIs.
  4. Access an API with Okta authentication
    API consumers are then able to use Okta authentication to consume Jitterbit custom, OData, or proxy APIs that the security profile is assigned to.

For additional information, see the Okta documentation OAuth 2.0 and OpenID Connect Overview.

For Okta 3-legged OAuth security profile configuration, see Okta 3-legged OAuth 2.0 API security profile.

1. Configure Okta as an identity provider

  1. Log in to the Okta Developer Console as a user with administrative privileges.

  2. In Okta's Developer Console, navigate to Applications > Applications, then click the Create App Integration button.

  3. In the Sign-in Method section of the Create a New App Integration page, select API Services and then click Next.

    attachment

  4. In the General Settings section of the New Web App Integration page, enter an App integration name and click Save:

    attachment

  5. After clicking Save, the Client ID and Client secret are displayed in the General tab under Client Credentials. Retain these for later use, as they will be required when generating an OAuth token in step 4.

    attachment

  6. Follow these additional steps to create a custom scope:

    1. Navigate to API > Authorization Servers and select the appropriate server.

    2. In the Authorization Server's Scopes tab, click Add Scope.

    3. In the Add Scope dialog, enter a Name (such as CustomScope) and complete the optional fields as desired. Retain the Name that you enter for later use, as it will be required when configuring the security profile. Under Metadata, select Include in public metadata. Click Create:

      attachment

2. Configure a 2-legged OAuth flow 2.0 API security profile

Follow the instructions for configuring an Okta 2-legged OAuth Flow in Security profile configuration.

During configuration, select OAuth 2.0 as the authentication Type and Okta as the OAuth provider:

attachment

Enter the name of the scope in the OAuth scope field. The scope name was specified by the user when configuring the scope in Okta, as shown in the previous section, Configure Okta as an identity provider.

attachment

The Authorized domains field must be empty:

attachment

Enter the OAuth client ID and OAuth client secret for testing purposes (optional):

attachment

Enter the audience. The Okta Audience can be found under Security > API under the authorization server's Settings tab.

attachment

Edit the OpenID discovery URL, the OAuth authorization URL, the OAuth token URL, and the User info URL to replace the placeholder domain (yourOktaDomain) and the placeholder authorization server ID (yourAuthServerId) with those for your Okta instance:

attachment

attachment

For example, when configured, the field input should be similar to that shown here:

attachment

Once the above fields have been populated, click Test to validate the authentication token.

3. Assign a security profile in API Manager

To use the security profile with an API, follow the instructions for configuring a custom API, OData service, or proxy API and select the security profile configured with Okta OAuth 2.0 authentication.

4. Access an API with Okta authentication

Once you have saved and published a custom API, OData service, or proxy API, its API is accessible by URL in the application calling the API using the configured authentication method.

Using 2-legged OAuth 2.0 is a two-step process:

  1. Generate an OAuth token either by passing the Okta client ID and client secret obtained above in step 1 in an RFC6749 Client Credentials Access Token Request to the new 2-legged OAuth Token URL link displayed on the Security Profiles page or by obtaining the OAuth token directly from Okta.

  2. Send the OAuth token in the API header using the "bearer" token type defined in RFC6750.

To consume the API, use the link to Copy URL and use it within the calling application:

attachment

If the API supports GET, you can also paste the URL into a web browser to consume the API manually.

When 2-legged OAuth Flow is being used, the API gateway fetches the access token and authentication takes place automatically.

If the authentication is successful, the expected payload is displayed in the web browser.