Manage Resource Servers
Use this section to configure resource server APIs/URLs and OAuth scopes in IDaaS so client applications can request JWT access tokens to access protected resources on behalf of users.
When to use this section
Use this section when you need to:
- Expose APIs/URLs as protected resources in IDaaS.
- Define scopes that control what client applications can access.
- Validate JWT access tokens in your APIs before allowing access.
Consider the following example:
Bank ABC wants to be able to provide a trusted client application access to user mortgage capability so partners can issue mortgage quotes to customers. Bank ABC creates a user mortgage API/URL and adds it as an authorized API/URL in IDaaS and provides corresponding scopes (view:mortgage, add:mortgage, edit:mortgage, remove:mortgage). The scopes correspond to the permissions the client application can request on behalf of the user. Bank ABC protects the mortgage API/URL by validating the JWT access tokens issued by IDaaS and presented by the client application.
Limitations
The following are OAuth maximums:
- Maximum of 100 APIs or URLs
- Maximum of 100 scopes per API or URL
- Maximum of 100 authorization roles
Topics in this section
Add a resource server
Manage OAuth authorization with a resource server.
Role-Based Access Control (RBAC)
Role-based access control allows you to configure the scopes that are contained within OAuth access tokens requested by client applications on behalf of users in order to access protected APIs/URLs. You create Access Management Roles and link them to scopes and users. Consider the following example:
Client credential grants
For each resource server you define, you can configure OIDC and OAuth Web and Server applications to request a JWT access token by using the client credentials grant. The client application uses this token to call the resource server API directly.
See also
For details about token behavior and lifecycle controls, see: