IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Oauth consent saved date

    Posted 07/08/21 10:22 PM
    Team,

    is it possible to retrieve consent saved date from Database or any predefined macros ? We would like to display the consent saved date to users

    Thanks


  • 2.  RE: Oauth consent saved date

    Posted 07/09/21 04:54 AM

    Hi Anju,

    It's not clear if you're asking about Verify SaaS or Verify Access.

    For Verify Access I don't know the answer.  I don't think the consent date is saved.

    For Verify SaaS, consent date information is saved if you are using the new Data Privacy and Consent Management component.  When using this, OAuth scope consents are saved within the consent management framework which means you can see the consent dates in the console and also should be possible to pull them out with REST API if you want to show to user.  If you set up an OIDC application before DPCM was available, there is an option in the UI which allows migration to DPCM.

    Jon.



    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Oauth consent saved date

    Posted 07/09/21 06:45 AM
    Jon,

    it is for Verify Access OIDC API.  As per my understanding Consent will expire based on Grant Lifetime and once grant lifetime elapsed user need to submit the consent form. I am just wondering without saved date how can we expire the consent. 

    Thanks






  • 4.  RE: Oauth consent saved date

    Posted 07/09/21 04:41 PM

    Hi Anju,

    Security Verify Access does not store the date the consent was given.  The associated tables in the HVDB are:

    COPY public.oauth_trusted_client (trusted_client_id, username, client_id) FROM stdin;
    532a54fd-edc6-407a-9783-6c7f172ffce2 iuser my_client_id

    --
    -- Data for Name: oauth_scope; Type: TABLE DATA; Schema: public; Owner: www-data
    --
    COPY public.oauth_scope (trusted_client_id, scope) FROM stdin;
    532a54fd-edc6-407a-9783-6c7f172ffce2 openid
    532a54fd-edc6-407a-9783-6c7f172ffce2 ScopeA

    These are populated when "Prompt once and remember" is used.



    ------------------------------
    Nick
    IBM Security Verify Customer Support
    ------------------------------



  • 5.  RE: Oauth consent saved date

    Posted 07/09/21 05:31 PM
    Nick ,

    Does the consent have expiration ? Once we saved the consent , will it be there forever ?

    Thanks




  • 6.  RE: Oauth consent saved date

    Posted 07/09/21 06:37 PM
    When using "Prompt once and remember" there is no expiration.  They remain until the user removes using /mga/sps/oauth/oauth20/clients.


    ------------------------------
    Nick
    IBM Security Verify Customer Support
    ------------------------------



  • 7.  RE: Oauth consent saved date

    Posted 07/10/21 12:12 AM
    Thank you nick for confirmation 

    Thanks