Powered by Zoomin Software. For more details please contactZoomin

Secure MarkLogic Server

Table of Contents

The OAuth Server Fields

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
Print
  • Last Updated: September 10, 2026
  • 3 minute read
    • MarkLogic Server
    • Version 12.0
    • Documentation

The OAuth Server fields appear when either Authentication or Authorization is oauth.

Field

Description

OAuth Flow Type

The flow type that the OAuth server will support:

  • Resource server: MarkLogic Server acts as a resource server, accepting tokens but erroring out if no token is provided.

  • Authorization code: MarkLogic Server both accepts tokens and obtains missing ones by redirecting the end user to log in to the Identity Provider (IDP) configured in OAuth Authorization Server URI. Choose this option if the app server with OAuth enabled has a UI (for example, the Admin Interface, Query Console, or Monitoring Dashboard).

  • Client credentials: If this option appears, do not select it. It was deprecated in MarkLogic 12.0 and removed in MarkLogic 12.1.

OAuth Vendor

The third-party authorization vendor that will be used with the OAuth server.

OAuth Authorization Server URI

[v12.1.0 and up]

(OAuth Flow Type = Authorization code) The authorization endpoint of the OAuth vendor where users are redirected to authenticate. This URI must support TLS (HTTPS).

OAuth Token Server URI

[v12.1.0 and up]

(OAuth Flow Type = Authorization code) The token endpoint used to exchange the authorization code for access tokens. This URI must support TLS (HTTPS).

OAuth Scope

[v12.1.0 and up]

(OAuth Flow Type = Authorization code) The scopes to be requested when initiating the Authorization code flow (for example, openid profile).

OAuth Client Authentication Method

[v12.1.0 and up]

(OAuth Flow Type = Authorization code) The method for authenticating the client when requesting access tokens from the token endpoint. Default is Client secret.

OAuth Client ID

The client ID of the OAuth server on the vendor.

OAuth Client Secret

[v12.1.0 and up]

(OAuth Flow Type = Authorization code and OAuth Client Authentication Method = Client secret) The client secret used to authenticate with the OAuth vendor. This value is stored in the MarkLogic internal keystore (KMS).

OAuth Redirect URI

[v12.1.0 and up]

(OAuth Flow Type = Authorization code) The URI where the user is redirected after authentication. This URI should be the URL of the MarkLogic app server (for example, https://<host>:<port>). This URI must support TLS (HTTPS) or be a loopback URI.

OAuth JWT Issuer URI

(OAuth Vendor = Microsoft Entra or Amazon Cognito) MarkLogic Server verifies that this URI matches the URI provided in the JWT Token.

OAuth Token Type

The access token format.

OAuth Username Attribute

(Required) The claim name to store the username information extracted from the access token.

OAuth Role Attribute

(Required) The claim name to store the role information extracted from the access token.

OAuth Privilege Attribute

(Optional) The claim name to store the privilege information extracted from the access token.

OAuth JWT Algorithm

(OAuth Token Type = JSON Web Tokens) The signature algorithm for JWT access tokens:

  • HS256 (Symmetric)

  • RS256 (Asymmetric)

OAuth JWT Secrets

The list of secrets MarkLogic Server should use to verify JWT access tokens, also known as validating the JWT access token signature.

  • If OAuth JWT Algorithm is a symmetric one, then use either Hex- or Base64URL-encoded JWT Secrets.

  • If OAuth JWT Algorithm is an asymmetric one, then use PEM-encoded JWT Secrets.

Note:

The JWT Secrets field secures both symmetric and asymmetric signature keys.

OAuth JWKS URI

(Optional) The JSON Web Key Set endpoint for obtaining JSON Web Keys. This URI must support TLS (HTTPS) or be a loopback URI.

Note:

If you are using an asymmetric algorithm, then you can specify a JWKS URI to validate incoming JWT access tokens with JWKS instead of with JWT Secrets signature keys.
Alert