Through JavaScript

To set up OAuth-based authentication and authorization with PingIdentity using JavaScript through the Query Console, follow these steps:

1. Create the external security object with code like this:

   Note:
   
   The JWT Secrets field secures both symmetric and asymmetric signature keys.

   Note:
   
   If you are using an asymmetric algorithm, then you can specify a JWKS URI to validate incoming JWT access tokens with JWKS instead of with JWT Secrets signature keys.

   Note:
   
   The parameters oauthAuthorizationServerUri, oauthTokenServerUri, oauthRedirectUri, oauthScope, oauthClientAuthenticationMethod, and oauthClientSecret are required only when using the Authorization code flow. These parameters configure the MarkLogic app server to act as an OAuth client. They are not needed for the Resource server flow.

   Resource server flow

   Copy

   declareUpdate();
   const sec = require('/MarkLogic/security');
   
   const oauthVendor = "Ping Identity";
   const oauthFlowType = "Resource server";
   const oauthClientId = "PingExampleClientID";
   const oauthTokenType = "JSON Web Tokens";
   const oauthUsernameAttribute = "username";
   const oauthRoleAttribute = "roles";
   const oauthPrivilegeAttribute = "privileges";
   const oauthJWTAlg = "RS256";
   const oauthJWTKeyIds = "PingExampleKeyID";
   const oauthJWTSecretValues = "<RS256 JWT Secret Value>";
   const oauthJWKSUri = "https://localhost/pf/JWKS";
   
   const oauth = sec.oauthServer(
   oauthVendor,
   oauthFlowType,
   oauthClientId,
   oauthTokenType,
   oauthUsernameAttribute,
   oauthRoleAttribute,
   oauthPrivilegeAttribute,
   "",
   oauthJWTAlg,
   oauthJWTKeyIds,
   oauthJWTSecretValues,
   oauthJWKSUri
   );
   
   sec.createExternalSecurity(
   'PingIdentityExampleOAuth',
   'PingIdentity external security object for OAuth',
   'oauth',
   300,
   'oauth',
   null,
   null,
   oauth); 
   

   Authorization code flow

   Copy

   declareUpdate();
   const sec = require('/MarkLogic/security');
   
   const oauthVendor = "Ping Identity";
   const oauthFlowType = "Authorization code";
   const oauthClientId = "<application-client-id>";
   const oauthTokenType = "JSON Web Tokens";
   const oauthUsernameAttribute = "username";
   const oauthRoleAttribute = "roles";
   const oauthPrivilegeAttribute = "privileges";
   const oauthJWTIssuerUri = "<jwt-issuer-uri>";
   const oauthJWTAlg = "RS256";
   const oauthJWTKeyIds = "<key-id>";
   const oauthJWTSecretValues = "<RS256 JWT Secret Value>";
   const oauthJWKSUri = "https://localhost/pf/JWKS";
   const oauthAuthorizationServerUri = "<oauth-server-authorize-endpoint>";
   const oauthTokenServerUri = "<oauth-server-token-endpoint>";
   const oauthRedirectUri = "https://<marklogic-host>:<app-server-port>";
   const oauthScope = "openid profile";
   const oauthClientAuthenticationMethod = "Client secret";
   const oauthClientSecret = "<client-secret-value>";
   
   const oauth = sec.oauthServer(
   oauthVendor,
   oauthFlowType,
   oauthClientId,
   oauthTokenType,
   oauthUsernameAttribute,
   oauthRoleAttribute,
   oauthPrivilegeAttribute,
   oauthJWTIssuerUri,
   oauthJWTAlg,
   oauthJWTKeyIds,
   oauthJWTSecretValues,
   oauthJWKSUri,
   oauthAuthorizationServerUri,
   oauthTokenServerUri,
   oauthRedirectUri,
   oauthScope,
   oauthClientAuthenticationMethod,
   oauthClientSecret
   );
   
   sec.createExternalSecurity(
   'PingIdentityExampleOAuthClient',
   'PingIdentity external security object for OAuth Authorization Code flow',
   'oauth',
   300,
   'oauth',
   null,
   null,
   oauth); 
   

2. Create any HTTP, XDBC, WebDAV, or ODBC app servers that you wish to configure with this external security object.

3. Configure your app servers to use this external security object with code like this:

   Copy

   declareUpdate();
   const admin = require('/MarkLogic/admin.xqy');
   const config = admin.getConfiguration();
   const groupid = admin.groupGetId(config, "Default");
   const appserver = "<app server name>";
   const extsec = "<external security object name>";
   
   admin.saveConfiguration(admin.appserverSetExternalSecurity(config, groupid, admin.appServerGetId(config, appserver), extsec, fn.false(), "oauth"));
   

4. Assign external names to your desired roles with code like this:

   Note:
   
   The external names are the values returned under the role attribute of the access token payload.

   Copy

   declareUpdate();
   const sec = require('/MarkLogic/security.xqy');
   
   const roleName = "<MarkLogic Server role name, for example, manage-user>";
   const externalName = "external-user-role";
   sec.roleSetExternalNames(roleName, externalName);
   

MarkLogic Server is now set up for OAuth-based authentication and authorization with PingIdentity.