As an OAuth authorization server, Access Policy Manager® (APM®) supports the grant types in this table.
|Authorization code||An OAuth client directs a resource owner to an authorization server. As the OAuth authorization server, APM authenticates the resource owner and directs it back to the client with an authorization code. The client then uses the authorization code to get an access token.|
|Implicit||A client gets a token from the authorization server directly, based on resource owner authorization and without the exchange of intermediate credentials (such as an authorization code). This grant type is optimized for clients that are implemented using a scripting language in a browser. (Refresh tokens are not available with this grant type.)|
|Resource owner password credentials||A client goes directly to the authorization server and uses the resource owner credentials to obtain a token.|
As an OAuth authorization server, Access Policy Manager® (APM®) supports the endpoints listed in this table for interactions with resource owners and clients on the BIG-IP® system. APM supplies default URIs for each endpoint. Users can replace the default URIs.
|Authorization Server Endpoint||Description|
|Authorization endpoint||As defined in the OAuth 2.0 authorization framework specification (RFC 6749), this endpoint is for use by a client to obtain authorization from the resource owner through user-agent redirection. The authorization server verifies the identity of the resource owner and interacts with the resource owner to obtain the authorization grant for the client. Defaults to /f5-oauth2/v1/authorize.|
|Token issuance endpoint||Specifies the endpoint for the client to use to obtain an access token or a refresh token, per RFC 6749. Defaults to /f5-oauth2/v1/token.|
|Token revocation endpoint||Specifies the endpoint for the client to use to revoke a previously obtained access token or refresh token, as an extension of RFC 6749. Defaults to /f5-oauth2/v1/revoke.|
|Token introspection endpoint||As defined in the OAuth 2.0 token introspection specification (RFC 7662), clients and resource servers get information about the token, such as its status (active or not active), the scopes assigned to it, issue date, expiration date, and so on. Defaults to /f5-oauth2/v1/introspect.|
As an OAuth authorization server, Access Policy Manager® (APM®) supports bearer access tokens, and refresh tokens.
As defined in the OAuth 2.0 specification (RFC 6749), an access token is a credential used to access protected resources. An access token is a string that represents an authorization issued to the client. A token represents specific scopes and durations of access granted by the resource owner. The resource server and the authorization server enforce the scopes and durations of access.
As defined in the OAuth 2.0 specification (RFC 6749), a refresh token is a credential used to obtain an access token. The client uses a refresh token to get a new access token from the authorization server when the current access token expires. If refresh tokens are enabled in the configuration, the OAuth authorization server issues a refresh token to the client when it issues an access token.
A refresh token is a string. It represents the authorization that the resource owner grants to the client. Unlike access tokens, a refresh token is for use with authorization servers only, and is never sent to a resource server.
You can configure a BIG-IP® system with Access Policy Manager® (APM®) to act as an OAuth authorization server. OAuth client applications and resource servers can register to have APM authorize requests.
Access policy for APM as an OAuth authorization server
The Logon Page and OAuth Authorization agents are required in the access policy for Access Policy Manager® (APM®) to act as an OAuth authorization server. An authentication agent, such as AD Auth, is optional; if included in a policy, an authentication agent should be placed after the Logon Page and before the OAuth Authorization agent.
When Access Policy Manager® (APM®) is configured to act as an OAuth authorization server, an OAuth Authorization agent must be present in the access policy.
The OAuth Authorization agent provides these elements and options.
Specifies the scopes for which authorization is requested. If no scopes are specified here, the scopes configured in APM for the client application are used.
The text on an OAuth authorization screen is a composite of captions and descriptions configured in a few different objects. When you set out to customize the authorization screen, you need to know where the text comes from.
An example OAuth Authorization screen
|1||OAuth Authorization agent, Authorize Message field.|
|2||Client application object, Website URL Logo field. (Providing a different logo for different locales is not supported.)|
|3||Client application object, Caption field.|
|4||Client application object, Detailed Description field.|
|5||Client application object, Caption field supplies the application name.|
|6||OAuth Authorization agent, Scope Message field supplies the phrase which defaults to request permission to do the following.|
|7||OAuth scope objects, Detailed Description field.|
|8||OAuth Authorization agent, Allow Message and Deny Message fields.|
If an access or per-request policy agent supports customization, customization settings are available in agent properties from within the visual policy editor. The same customization settings are also available for the agent in the support.f5.com.area of the BIG-IP® system. For more information, see BIG-IP® Access Policy Manager® (APM®) Customization on the AskF5™ web site located at
Access Policy Manager® (APM®) stores access tokens in on-disk databases for their lifetimes.
oauth_id purged_time --------------------------------------------------------------------------- 07c64b01e360f43ff4e2b561107de9f4aa5ca14e54b5e72e 2016-09-29 02:00:01
Access Policy Manager® (APM®) collects OAuth performance statistics on the BIG-IP® system. After you configure and start to use APM as an OAuth server or an OAuth client and resource server, APM collects statistics without requiring any additional setup.
The interval between two consecutive points in an OAuth performance chart depends on the time period selected for the chart.
|Last hour||30 seconds|
|Last 3 hours||1 minute (60 seconds)|
|Last 12 hours||6 minutes (360 seconds)|
|Last day||12 minutes (720 seconds)|
|Last week||1 hour (3600 seconds)|
|Last 30 days||4 hours (14400 seconds)|
|Last 3 months||12 hours (43200 seconds)|
|Last 6 months||1 day (86400 seconds)|
The OAuth access token report displays a status for each token. This table defines each status.
|Access Token Status||Description|
|ACTIVE||A token status is active when the token is granted and remains active until an event occurs that changes the status.|
|EXPIRED||Token status changes to expired only when a validation request is attempted on a token that has passed its expiration date.|
|EXPIRED||Token status changes to revoked when a client or an administrator revokes that access token.|
You might run into problems with an OAuth authorization server on the BIG-IP® system in some instances. Follow these tips to try to resolve any issues you might encounter.
|Log message||Possible explanations and corrective actions|
|Invalid grant type requested in OAuth mode||An OAuth profile might not be specified in the access profile. Verify that the access profile specifies an OAuth profile.|
|OAuth mode not set for Authorization Agent: Incoming OAuth request might not match the configured OAuth endpoints or could be failing for other reasons.||Incoming OAuth request might not match the configured OAuth endpoints.|
|OAuth mode not set for Authorization Agent: OAuth profile is not configured for this access profile.||OAuth profile is not specified in the access profile.|
|The client app does not support Auth code grant||The Authorization Code grant type is not selected in the client app configuration.|
|The client app does not support Implicit grant||The Implicit grant type is not selected in the client app configuration.|
|The client app does not support ROPC grant||The Resource Owner Password Credentials grant type is not selected in the client app configuration.|
|OAuth mode not set for Authorization Agent||An OAuth profile might not be specified in the access profile. Verify that the access profile specifies an OAuth profile.|
|Invalid Scope: 'name'||The client application sent a request with an invalid scope, name.
|Client ID 0fb9b2... IP 184.108.40.206 attempted to use Auth Code 03f59e... given to client ID 093eb2...||
A client application tried to use an authorization code that the Authorization Server provided to another client application. Any remediation action, such as unregistering the app, is at the admin's discretion.
|Client ID 093eb2... IP 220.127.116.11 attempted to use already consumed Auth Code 03f59e...||An authorization code can be used to retrieve an access token once only. This error message indicates that the Authorization server detected a client application presenting the same authorization code to retrieve an access token more than once. Any remediation action, such as notifying the app developer or unregistering the app, is at the admin's discretion.|
|Failed to initiate DB synchronization (ERR_DB)||The error code might help indicate what problem was seen. This error can also occur if the OAuth plugin restarted.|
|Request Introspect Token from ID bd3d27... IP 18.104.22.168 failed. Error Code (invalid_request) Error Description (Required parameter (resource_server_secret) is missing)||The error description field provides the detailed reason why a request failed. The reason could vary from missing a required field in the request to an out-of-memory situation in the traffic management microkernel (TMM) process, and so on. The error description should be detailed enough to help with troubleshooting.|
|Request Auth Code from Source ID 052ae66... IP 22.214.171.124 failed. Error Code (server_error) Error Description (Assigned scopes exceed buffer size limit.)||All assigned scopes (space separated) are returned to the client application.
However, if all assigned scope names exceed 1000 bytes, this error message will be
generated. To resolve the problem, you can:
Note: The maximum length for one scope name is 400 characters. The maximum length for all the scope names assigned to the client app and separated by spaces is 1000 characters (1000 bytes).
|Request Auth Code from Source ID 052ae6... IP 126.96.36.199 failed. Error Code (server_error) Error Description (Assigned scopes cause scope_data to exceed buffer size limit.)||Scope data (scope_data) is JSON-formatted output that contains all assigned scope
names and their values. Whenever the JSON-formatted output length exceed 4000 bytes,
this error is generated. To resolve the problem, you can:
Note: The maximum length for one scope name is 400 characters. The maximum length for one scope value is 3500 characters. The maximum length for all scope data (scope names, scope values, spaces, and formatting characters) is 4000 characters (4000 bytes).
|Failed to register OAuth global tmstat table (ERR_MEM)||These are OAuth global TMSTAT initialization related failures. These events are unlikely. Restarting TMM could help. For more information, refer to SOL89999342: BIG-IP daemons (12.x) on the AskF5™ web site located at support.f5.com.|
|Failed to create OAuth global tmstat row (ERR_MEM)|
|Failed to set OAuth global tmstat field name (ERR_MEM)|
|Failed to get OAuth global stats row during tmstat initialization (ERR_UNKNOWN)||This is an OAuth global TMSTAT initialization related failure. This is an unlikely event. Restarting TMM could help.|