IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  ISAM OAuth Client with extended properties

    Posted Thu January 30, 2020 10:36 AM
    ​Hello,

    we implement a ISAM developer portal based on this example: https://www.ibm.com/blogs/security-identity-access/oauth-building-developer-portal/

    The Client should be created including extended properties (JSON).

    However the following code is not working:

    var json = '{"result":true, "count":42}';
    var extProp = JSON.parse(json);
    client = OAuthMappingExtUtils.createClient("client1", clientId, "client1", "company", null, redir,"https://company.com","user1","user1@email.com","11111", "other", "otherinfo", false, null, null, null, extProp);

    Without it works:

    client = OAuthMappingExtUtils.createClient("client1", clientId, "client1", "company", null, redir,"https://company.com","user1","user1@email.com","11111", "other", "otherinfo", false, null, null, null);

    Any hints how to do this?

    ------------------------------
    Jürgen Hitt
    ------------------------------


  • 2.  RE: ISAM OAuth Client with extended properties

    Posted Fri January 31, 2020 04:04 AM
    Hi Jürgen,

    First, I'd verify the ISAM release you are using since these "extension properties" are relatively new: 9.0.6 I believe. See the Javadoc for a detailed description of the OAuthMappingExtUtils.createClient() of the release you are using.

    What's the result code you're getting back from the JSON.parse? I may help to troubleshooting the problem.

    Also I believe I've read somewhere that these properties must be key-value pairs of strings.
    So try var json = '{"result":"true", "count":"42"}' instead of var json = '{"result":true, "count":42}';

    Good luck & regards, Peter

    ------------------------------
    Peter Volckaert
    Senior Sales Engineer
    Authentication and Access
    IBM Security
    ------------------------------



  • 3.  RE: ISAM OAuth Client with extended properties

    Posted Fri January 31, 2020 05:18 AM
    ​Hi Peter,

    we use ISAM 907 fixpack 1.

    I also tried with key-value pairs of strings:

    var redir = ["https://testClient.com"];
     var clientId = OAuthMappingExtUtils.generateRandomString(20);
    var json = '{"result":"true", "count":"42"}';
    var obj = JSON.parse(json);
    client = OAuthMappingExtUtils.createClient("test", clientId, "test", "company", null, redir,"https://some.de","username1","emial1@test.de","49444", "other", "otherinfo", false, null, null, null, obj);
     
    The error I get is:

    Caused by: org.mozilla.javascript.EvaluatorException: Can't find method com.tivoli.am.fim.trustserver.sts.utilities.OAuthMappingExtUtils.createClient(string,java.lang.String,string,string,null,object,string,string,string,string,string,string,boolean,null,null,null,object)

    ------------------------------
    Jürgen Hitt
    ------------------------------



  • 4.  RE: ISAM OAuth Client with extended properties

    Posted Fri January 31, 2020 05:47 AM
    Hi Jürgen,

    I assume you execute OAuthMappingExtUtils.createClient() in a supported context. The supported contexts are: one-time password, OAuth or API protection mapping rules, federation mapping rules, and  access policies. Reference: https://www.ibm.com/support/knowledgecenter/en/SSPREK_9.0.7/com.ibm.isam.doc/config/concept/con_otp_customize_mapping_rules_gs_aac.html

    Just to be sure: did you import the right class in the beginning of your script? Like this:
    importClass(Packages.com.tivoli.am.fim.trustserver.sts.utilities.OAuthMappingExtUtils);

    Kind regards, Peter.




    ------------------------------
    Peter Volckaert
    Senior Sales Engineer
    Authentication and Access
    IBM Security
    ------------------------------



  • 5.  RE: ISAM OAuth Client with extended properties

    Posted Fri January 31, 2020 07:52 AM
    Hi  Jürgen,

    The following snippet works for me:
    var json_obj = {"result":true, "count":42};
    var extProp = JSON.stringify(json_obj);
    var redirUrls = java.lang.reflect.Array.newInstance(java.lang.String, 2);
    redirUrls[0] = "http://127.0.0.1";
    redirUrls[1] = "https://127.0.0.1";
    let created_client = OAuthMappingExtUtils.createClient("api-defintion", "clientId", "clientName", "companyName", "clientSuperSecret", (redirUrls), "https://company.com",   "",   "",    "",     "OTHER",     extProp,     false,    "",      "",        "");
    
    if (created_client == true) {
      IDMappingExtUtils.traceString("created client");
    } else {
      IDMappingExtUtils.traceString("failed to create client");
    }

    However, I seem unable to create/modify the extended data, there seems to be no way to manipulate it from the Mapping Rules as far as I can see from the JavaDoc, maybe IBM can confirm?

    Regards,
    Dries



    ------------------------------
    Dries Eestermans
    IS4U
    ------------------------------



  • 6.  RE: ISAM OAuth Client with extended properties

    Posted Fri January 31, 2020 09:48 AM
    Edited by Peter Volckaert Fri January 31, 2020 10:05 AM
    Hi,

    The error message says:
    Caused by: org.mozilla.javascript.EvaluatorException: Can't find method com.tivoli.am.fim.trustserver.sts.utilities.OAuthMappingExtUtils.createClient(string,java.lang.String,string,string,null,object,string,string,string,string,string,string,boolean,null,null,null,object)

    So I assume the documentation is not up-to-date, but the code does expect the extension properties.​ But not in the "otherInfo" attribute, which is a type string, but rather as the last input parameter. Note that there are 17 input parameters in total. (While the documentation suggests there are 16, but it's likely that the doc is wrong)

    Hope this solves your problem.

    Kind regards, Peter

    ------------------------------
    Peter Volckaert
    Senior Sales Engineer
    Authentication and Access
    IBM Security
    ------------------------------