IBM Verify

Hi, Can anyone help point me in the correct direction to do the following ….

I'm trying to configure Mutual TLS from a client on a request for an OAuth 2.0 token (URI mga/sps/oauth/oauth20/token) for the client certificate to be mapped to an OAuth 2.0 client. (As part of specification RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens https://datatracker.ietf.org/doc/html/rfc8705)

We are currently using IBM Secure Verify Access 10.0.2 docker containers (although plan to update to v11) and have requests for OAuth 2.0 tokens working with basic authentication and JWT authentication. But I’m sure which instructions I should be following to use client certificate authentication instead.

I’ve found:

• Certificate authentication configuration task summary https://www.ibm.com/docs/en/sva/10.0.2?topic=authentication-certificate-configuration-task-summary but do I need to configure an external authentication mechanism as per Configuring EAI certificate authentication https://www.ibm.com/docs/en/sva/10.0.2?topic=authentication-configuring-eai-certificate and if so, can I use the FAPI_CertEAI as per https://www.ibm.com/docs/en/sva/10.0.2?topic=conformance-fapi-mtls-certificate-bound-tokens
• Client Certificate User Mapping https://www.ibm.com/docs/en/sva/10.0.2?topic=methods-client-certificate-user-mapping 
  
• But assume I need to configure something in AAC > OpenID Connect and API protection or Federation > Security Token Service so that an OAuth 2.0 grant_type=client_credentials flow will accept a client mapped from a client certificate without a password.

I can successfully complete TLS handshake with WRP, but missing how to map client certificate to an OAuth 2.0 client. I tried each of the above instructions with various errors but mostly runtime container messages.log issues: "ivoli.am.fim.oauth20.protocol.delegates.OAuth20TokenDelegate I com.tivoli.am.fim.oauth20.exception.OAuth20InvalidClientException: FBTOAU229E Confidential clients accessing the token endpoint must authenticate using their registered credentials."

Thanks, Sue