OAuth

OAuth authentication is available on all server types.

OAuth can be used only with the OAuth authorization scheme.

To use OAuth, you must also configure External Security.

There are three major components to OAuth:

• The Authorization Server, which authenticates a client and provides an Access Token.

• The Access Token, which is included in requests to the Resource Server.

• The Resource Server, which validates the Access Token and sends the requested resources to the client. MarkLogic Server is a Resource Server.

MarkLogic Server supports two OAuth flow types:

• Resource server: MarkLogic Server acts solely as a resource server. It accepts and validates tokens included in request headers, but returns an error if no token is provided. Use this flow when your application handles its own token acquisition from the OAuth vendor.

• Authorization code: MarkLogic Server acts as both a resource server and an OAuth client. If no valid token is present, then MarkLogic Server redirects the end user to the OAuth vendor's authorization endpoint to authenticate. After authentication, the user is redirected back with an authorization code that MarkLogic Server exchanges for an access token. Use this flow for MarkLogic app servers that have a UI (for example, the Admin Interface, Query Console, or the Monitoring Dashboard).