Manage Progress Application Server (PAS) for OpenEdge

Generate an access and ID token pair

Save PDF

Generate an access and ID token pair

Save PDF

Last Updated: January 16, 2024
3 minute read

OpenEdge
Version 12.8
Documentation

Description

Generates a base64-encoded JSON string containing an OAuth2 access token and ID token. Both tokens are stored in the server cache for introspection requests. The System Administrator must configure PAS for OpenEdge and OpenEdge Authentication Gateway to supply the required claims.

For more information on PAS for OpenEdge security configurations, see $DLC/servers/pasoe/conf/oeablSecurity.properties.README.
For more information on OpenEdge Authentication Gateway security configurations, see ../conf/oeablSecurity.properties.README file.

OESECTOOL does not support generating opaque access tokens. Use a non-opaque token to test remote validation configurations. The ID token uses the properties with the id.token prefix to configure the identity token claims.

Configure the OAuth2 server properties

Edit the oesectool-oauth2.properties file to work with the PAS for OpenEdge or OpenEdge Authentication gateway configurations as follows:

Set the user ID for the users.
sectool.user.ids=user1,user2

Set the properties for the users.

user1.sub="yshre@progress.com"
user1.preferred_username="yshre@progress.com"
user1.given_name="York"
user1.family_name="Shrek"
user1.name="York Shrek"
user1.email="yshre@progress.com"
user1.locale="US"
user1.id="00u2k1xc0fHUEeghc5d7"
user1.zoneinfo="America/Los_Angeles"
user1.scope="PSCUser"

user2.sub="kludil@progress.com"
user2.preferred_username="kludil@progress.com"
user2.given_name="Kunel"
user2.family_name="Ludilschik"
user2.name="Kunel Ludilschik"
user2.email="kludil@progress.com"
user2.locale="US"
user2.id="00u2k1xc0fHUEeghclmc"
user2.zoneinfo="America/Los_Angeles"
user2.scope="PSCUser"

Set the claims.

Set the access token claims with access.token. prefix for user1, including:

#access.token.
access.token.ver=1
access.token.jti="${general.access_token_jti}"
access.token.iss="${general.iss}"
access.token.aud="${general.aud}"
access.token.sub="${${sectool.user.id}.sub}"
access.token.iat=now
access.token.exp=now+1h
access.token.cid="${general.cid}"
access.token.uid="${${sectool.user.id}.id}"
access.token.scope="${${sectool.user.id}.scope}"
access.token.scp=["openid","email","profile"]
access.token.token_use="access"

Note: Values ${${sectool.user.id}.sub} and ${${sectool.user.id}.id} are the sub and id properties for a user. For example:

user1.sub="kyork@progress.com"
user1.id="00u2k1xc0fHUEeghc5d7"

Time properties are:

 now[+|-{y|M|d|h|m|s}{integer}]

where:

now—current time
y —year
M —month
d —day
m—minute
s—second

Set the ID token claims with access.token. prefix for user1, including:

#id.token.
id.token.ver=1
id.token.jti="${general.id_token_jti}"
id.token.iss="${general.iss}"
id.token.aud="${general.aud}"
id.token.sub="${${sectool.user.id}.sub}"
id.token.name="${${sectool.user.id}.name}"
id.token.email="${${sectool.user.id}.email}"
id.token.iat=now
id.token.exp=now+1h
id.token.amr=${general.amr}
id.token.idp="${general.idp}"
id.token.preferred_username="${${sectool.user.id}.preferred_username}"
id.token.auth_time=now
id.token.at_hash=0

Note: Users may add or remove claims.

Signed the prepared access token must be signed using the security key defined in one of the following ways:
1. By using a client oesectool shared secret.
2. By using a private key from a PAS for OpenEdge keystore.
  1. Shared secret is defined by the token.key.secret property. PAS for OpenEdge oeablSecurity.properties has the jwtToken.macKey property, which has the same value. This value is encrypted.
  2. Comment out token.key.secret because there are a number of ways to obtain a public key to validate signature, including:
    - Request the public keys from the oauth2server.
    - Request the configuration properties from the oauth2server—Extract the URL to get public keys. Get jwks_uri to call oauth2server, to get public keys and the verified PEM file with a public key or certificate.
    - Use a PEM file with a public key or certificate.
3. Optional. To the JWE tokens, provide the following properties that match PAS for OpenEdge and the subset available for OpenEdge Authentication Gateway properties:
```
token.key.encalias - a key alias from PASOE keystore. Example: defaultkey
token.key.encalg - algorithm to use. Example: RSA-OAEP-256
token.key.encmethod - encryption method. Example: A256CBC-HS512
```
  Note: The OpenEdge Advanced Security add-on is required to use JWE tokens.

HTTP Operation

GET

URL

http[s]://hostname:port/token/username

Command-line example

curl http://localhost:8888/token/user1

Response

{"access_token":"eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJvZWFibGFwcCIsInN1YiI6InlzaHJlQHByb2
dyZXNzLmNvbSIsInVpZCI6IjAwdTJrMXhjMGZIVUVlZ2hjNWQ3Iiwic2NwIjpbIm9wZW5pZCIsImVtYWlsIi
wicHJvZmlsZSJdLCJ2ZXIiOjEsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiUFNDVXNlciIsImlzcy
I6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTk5OSIsImV4cCI6MTY4OTcxMzMwOCwiaWF0IjoxNjg5NzA5NzA4LC
JqdGkiOiJBVC43WUhHQWFvaHJDQWFndW42TlNJWklPUzZTRVZZVHJVRmM1ZzZGSEh2VDRnIiwiY2lkIjoib2
VhYmxDbGllbnQifQ.S4h_TPlqjbYCdONQsTFT8o807Fu0XzN9f72o0krHOo5C6kbsdviDnmItYya5i3zlh-2
zMK4BMC8ioyMuuBWyuJjey0tuQTe9oRcwavwkhylwmdCk1R1bRcmE8TAn_0QudX5B79pDqZ6DRiYZ65C_tcS
RhdJn0PnUx2lSoDpXXfrxOKaQps39KU5qrseK3iuwvZGrjAH4H88rZOUPRy1A9VnkkcWEIOtCCGD5Gmw-d10
wLBL75FMiCrSA7wtExUDh7UdqktjgVDyygepn8ByYTVEbek3KQiHCpZ4X_-n8zYuCWAYBzAx1lLABpvRrgOQ
v6319YUcuD9u1y9hC4CYCRA",

"id_token":"eyJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiT3Y5Q2p0dH
N1dkVcLzJmNHdmSVwvdjhRPT0iLCJzdWIiOiJ5c2hyZUBwcm9ncmVzcy5jb20iLCJ2ZXIiOjEsImFtciI6Wy
Jwd2QiXSwiaXNzIjoiaHR0cHM6XC9cL2xvY2FsaG9zdDo5OTk5IiwicHJlZmVycmVkX3VzZXJuYW1lIjoieX
NocmVAcHJvZ3Jlc3MuY29tIiwiYXVkIjoib2VhYmxhcHAiLCJpZHAiOiIwMG8yazF4YnV2Q3pieHE4MTVkNy
IsImF1dGhfdGltZSI6MTY4OTcwOTcwOCwibmFtZSI6IllvcmsgU2hyZWsiLCJleHAiOjE2ODk3MTMzMDgsIm
lhdCI6MTY4OTcwOTcwOCwianRpIjoiSUQuVDRxbjUzUGJ2Q0NVSnk3eHFPY1dtUElFamYtSHlXWjlRUVAxRG
JXal9ibyIsImVtYWlsIjoieXNocmVAcHJvZ3Jlc3MuY29tIn0.Gr8z55A9baduAnYeTXMrmMKbB_l0ZadH7a
ezzcGJmzemxmDNaxxlDFz6AvmL8DBgjErlhMLL3uzizRsO5lZazRxC93-laFkXL0Tsl_Kzo8ZP2UFz6Lj7W0
HmRlOL8Xi3q_P8ZkkJh66ZxcQ-pebZ6GO7yHMsGrqz6OSDWoXwL-ayx7JcVE-WPspDOoin1KgrZkXZQtyWyK
l6sEfkjiBLsKMZ417SBEwG3RG3waWkC6QI-zHb9gGg4fnk6QWHy8s76jjs4DSS_oqOt5ilCO2Biw-rhFu6wC
Wd74_W4s2KCr0hqmtC91sFA-Fx8EuQ2iwpk2_3Q4VZBfC4mS0CQtVhPQ"}

Note: The response has been formatted to fit the page and to separate the tokens.

The result has two tokens:

Access token:

access_token:
Header:
{  "alg": "RS256"}
Payload:
{
  "aud": "oeablapp",
  "sub": "yshre@progress.com",
  "uid": "00u2k1xc0fHUEeghc5d7",
  "scp": [
    "openid",
    "email",
    "profile"
  ],
  "ver": 1,
  "token_use": "access",
  "scope": "PSCUser",
  "iss": "https://localhost:9999",
  "exp": 1689713308,
  "iat": 1689709708,
  "jti": "AT.7YHGAaohrCAagun6NSIZIOS6SEVYTrUFc5g6FHHvT4g",
  "cid": "oeablClient"
}

ID token:

Header:
{"alg": "RS256"}
Payload:
{ "at_hash": "Ov9CjttsuvE/2f4wfI/v8Q==",
  "sub": "yshre@progress.com",
  "ver": 1,
  "amr": [
    "pwd"
  ],
  "iss": "https://localhost:9999",
  "preferred_username": "yshre@progress.com",
  "aud": "oeablapp",
  "idp": "00o2k1xbuvCzbxq815d7",
  "auth_time": 1689709708,
  "name": "York Shrek",
  "exp": 1689713308,
  "iat": 1689709708,
  "jti": "ID.T4qn53PbvCCUJy7xqOcWmPIEjf-HyWZ9QQP1DbWj_bo",
  "email": "yshre@progress.com"
}