Configuring the OAuth2 Server Settings in Privileged Access Manager

  1. Log in to the Privileged Access Manager console.

  2. Navigate to Settings > External Services > OAuth2 Server.

  3. Specify the Client ID and Client Secret that are generated while configuring the OAuth2 event in Advanced Authentication.

  4. Specify login URL of the Advanced Authentication server to direct the users for authentication in OAuth2 Authorization URL.

    NOTE:Privileged Access Manager 4.2 supports the Advanced Authentication server with OSP as the OAuth2 server. Therefore, examples include IP address of AA/OSP. In the upcoming releases, support will extend for other authorization servers.

    For example, https://<ip-address-or-dns-or-advanced-authentication>/osp/a/TOP/auth/oauth2/grant

  5. Specify the token URL that initiates the authentication request in OAuth2 Token URL.

    For example, https://<ip-address-or-dns-or-advanced-authentication>/osp/a/TOP/auth/oauth2/token

  6. Specify the location from where the information of users are retrieved post authentication in OAuth2 User Info URL.

    For example, https://<ip-address-or-dns-or-advanced-authentication>/osp/a/TOP/auth/oauth2/userinfo

  7. Specify the URL to log users out of the authentication session in OAuth2 Logout URL.

    For example, https://<authorization server ip address>/osp/a/TOP/auth/oauth2/logout

  8. Retain default settings for Enforce OAuth for Web Authentication and Retrieve authorization attributes from LDAP Server.

  9. Save the settings.

NOTE:After completing the configurations, you must map the LDAP servers to assign the browsing capability to User roles in Access Control.

NOTE:Use one of the following URLs to authenticate to Privileged Access Manager using the OAuth2 authorization protocol:

  • Old console: https://pam_ip_or_dns/sso?console=legacy

  • New console: https://pam_ip_or_dns/sso/