Hello,

I follow Leos blog: https://www.ibm.com/blogs/security-identity-access/oauth-dynamic-client-registration/

Two questions:

We have access policies put on our definitions (check group membership and auth level). After troubleshooting a while I figured out that this is the reason why dynamic client reg. was not working. Is there any suggestion what to do? Something I need to code into the access policy?

After removing the access policies I was able to register client /mga/sps/mga/user/mgmt/html/create_client.html. The client shows up in /mga/sps/mga/user/mgmt/html/device/device_selection.html . However the client does not show up in LMI. Is this normal behaviour?

Regards,
Juergen

------------------------------
Jürgen Hitt
------------------------------

Hi Jürgen, 

You may need to tweak your access policy to have an allow clause on the register endpoint if the authorization requirements of your other policies are not being met by the session used to attempt a dynamic client register, If the configured policies result in an MFA prompt, the create_client.html page may not correctly handle the prompt in the AJAX call it performs to register the client. 

Dynamic clients dont show up in the LMI along static clients, however there is an API which lets you list and manage dynamic client registrations, you can see the list API here: https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/develop/rapi/Retrieve%20several%20dynamically%20registered%20clients.xml

You can find these APIs in the rest API documentation here:
https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/develop/rapi/index.html


Please let me know if you want any further clarifications. 

------------------------------
Leo Farrell
------------------------------