Configuration
  • ●
    Configure the Airlock IAM OAuth 2 Client, i.e. an Oauth2 Target Application: see OAuth 2 / OpenID Connect Configuration: Airlock IAM as Authorization Server
  • ●
    One-Shot End-Point in IAM: (Loginapp >> Airlock One-Shot Authentication)
    • ●
      Add a target application for the protected service and configure it as follows:
    • ●
      Credential Extractor: use plugin Bearer Token HTTP Header Extractor (as Token Credential).
    • ●
      Authenticator:  use plugin OAuth 2 Access Token Authenticator with the Authorization Server Settings used in the above Oauth2 target application.
    • ●
      Failure Responses: configure responses as desired - always use responses of type FINAL_RESPONSE.
    • ●
      Identity Propagator: as required by back-end application.
    • ●
      URL pattern: according to the back-end application.
    • ●
      Airlock Credentials: Choose sensitive Airlock Gateway (WAF) credential timeouts.

      • Shared One-Shot Configuration

      The one-shot settings can be used for multiple protected services. Choose the URL pattern property to match all services for which the same settings apply.

  • ●
    Airlock Gateway (WAF) Configuration
    • ●
      Make sure the Gateway (WAF)'s IAM mapping has the allow rules for Oauth2 enabled
    • ●
      Create a mapping for the protected service(s)
    • ●
      As Denied access URL, use /<iam-mapping-entry-path>/login-oneshot
    • ●
      From the Authentication flow drop-down, select One-Shot
    • ●
      Enable bearer token session tracking in the Security Gate Expert Settings (on both the IAM mapping and the protected services mapping(s)):
      • Session.Tracking.ExternalToken.Enable                     "TRUE"