4.4.2 OAuth2 Server Settings

To integrate Privileged Access Manager with OAuth2 server, it is necessary to configure the authorization server details in Privileged Access Manager. You can fetch the OSP OAuth server cfg using the API: \ncurl --insecure https://10.71.16.158/osp/a/TOP/auth/oauth2/.well-known/oauth-authorization-server

NOTE:Privileged Access Manager 4.2 supports only the Advanced Authentication server as the OAuth2 server. In the upcoming releases, support will extend for other authorization servers. Also, PAM can leverage Risk Service configured in Advanced Authentication.

NOTE:You can obtain the following details while configuring the OAuth2 authorization server.

To configure the authorization server details, perform the following:

  1. Click Settings > External Services > OAuth2 Server on the Privileged Access Manager console.

  2. Specify the following details:

    Field

    Details

    Client Configuration

    Client ID

    A unique ID that is generated when you configure the authorization server.

    Client Secret

    A unique value that is generated when you configure the authorization server. This value is shared between the OAuth client (Privileged Access Manager) and the authorization server.

    Select Edit Secret to edit the Client Secret post integration with the authorization server.

    Server Endpoints

    OAuth2 Authorization

    Login URL of the authorization server to prompt the users for authentication and directs to the Redirect URL. Login URL must be specified in the following format:

    https://<authorization server ip address>/osp/a/TOP/auth/oauth2/grant

    OAuth2 Token URL

    Token URL that the client uses to initiate the request. This token is issued by the authorization server. Token URL must be specified in the following format:

    https://<authorization server ip address>/osp/a/TOP/auth/oauth2/token

    OAuth2 User Info URL

    : An endpoint from where you can retrieve the user information after authentication. User info URL must be specified in the following format:

    https://<authorization server ip address>/osp/a/TOP/auth/oauth2/userinfo

    OAuth2 Logout URL

    URL that logs the user out of authentication session. Logout URL must be specified in the following format:

    https://<authorization server ip address>/osp/a/TOP/auth/oauth2/logout

    Enforce OAuth for Web Authentication

    The OAuth authentication framework is applied for web-based applications by default. With this option disabled, the administrator allows users to the web console login by other external authentication that is configured, such as LDAP, RADIUS, and so on. Users can log in with the URL https://<privilege-account-manager-ipaddress>/pam.

    NOTE:This option does not apply to local users, ssh relay, and credential providers.

    Retrieve authorization attributes from LDAP Server

    By default, this option gathers the authorization attributes, such as email address, groups with which the user is associated, and so on, from LDAP Server post-authentication. Some attributes are essential in access control, like group DN that verifies the user's group before granting the access.

     

     

  3. Save the configuration.