Single Sign-On Service › SSO Getting Started Guide › Configure and Apply an OAuth Authentication Scheme

Configure and Apply an OAuth Authentication Scheme

OAuth is an open standard for authorization. It enables users to share resources without sharing their identity. You can permit access to one site for resources stored on another site.

The host Policy Server performs its authentication by first directing the user to the authorization server. User authentication is initially done by an OAuth authorization server, which issues an authorization token upon a successful authentication. The token is the means by which the Policy Server retrieves user information then authenticates the user based on these claims. Upon successful authentication, the user gets access to the target resource.

Users can sign-on with OAuth authentication servers, such as Google and Facebook. Users can authenticate themselves with OAuth credentials and access a protected resource.

If a user does not have a CA CloudMinder account, you can enable self-registration. The first time a user attempts to sign-on through an OAuth provider, the user is prompted to create a CA CloudMinder account. The user can then proceed with sign-on. On subsequent log-ins, the user signs on through the OAuth provider with no interruption.

These instructions provide the steps to configure OAuth authentication between CA CloudMinder as the Service Provider and Google or Facebook as the Identity Provider. These instructions also provide the steps to configure self-registration for Oauth authentication.

The following figure shows the configuration procedure. Before you begin OAuth configuration, we strongly recommend that you review this entire OAuth configuration process document.

Complete the configuration tasks:

1. Register an application with an OAuth provider.
2. Confirm the OAuth Plug-In.
3. Copy and Modify the OAuth Provider Configuration File.
4. Customize the SPS Server Files for OAuth.
5. Copy and Modify the OAuth Properties File.
6. Copy and Modify the OAuth Open Format Expression File (optional).
7. Set Openformat Cookies Properties (optional).
8. Configure the Custom OAuth Authentication Scheme.
9. Enable OAuth Authentication Method for Tenant Environment.
10. Apply OAuth Authentication Method to Tenant.
11. Use the Authentication Scheme in a Policy.
    1. Select the Policy Domain for the Tenant.
    2. Assign User Directories to the Tenant Domain.
    3. Configure a Realm and a Rule for the Tenant Domain.
    4. Create the Policy to Protect the Authentication URL.
12. Complete OAuth Self-Registration Configuration.
    1. Create a Rule for Self-Registration.
    2. Create a Response for Self-Registration.
    3. Add Self-Registration Rule and Response to the Policy.