---
schema_version: "1"
id: 50bb4b2b1b1b5813ef62ca5e5513a6e5dd4ae32e7faf04b506f2c8cd143a8dd9
title: Migrating the OAuth2 Provider
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.3/migration-oauth2-provider.md
canonical_url: https://docs.mulesoft.com/mule-runtime/4.3/migration-oauth2-provider
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 9105481a7d10ef3e6b8c2f7a073786bc19429b448ae860fa22b71d1c8e4bf86b
description: MuleSoft Documentation Site
release: "4.3"
latest: false
---
---
product: Mule Runtime
version: 4.3
---

# Migrating the OAuth2 Provider

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The new OAuth2 Provider Module from Mule 4 comes to replace the previous provider from the Anypoint
Enterprise Security. However, there are some configuration changes that need to be taken into
account when migrating the applications.

## Global Configuration Migration

The following are the changes made in the Providers global configuration and the differences that
they have between versions.

### Changed Attributes

Attribute status:

- Kept: Has same name, type and location.

- Moved: The attribute has the same type and name but the location where it should be configured
  changed.

- Changed: The type or name changed but the location is the same.

- Removed: The attribute no longer exists.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Mule 3 Attribute</th><th>Status</th><th>Mule 4 Config</th></tr></thead><tbody><tr><td><p>Name</p></td><td><p>Kept</p></td><td><p>Name</p></td></tr><tr><td><p>Provider Name</p></td><td><p>Kept</p></td><td><p>Provider Name</p></td></tr><tr><td><p>Host</p></td><td><p>Removed</p></td><td><p>The host is taken from the Http Configuration in <strong>Listener Config</strong></p></td></tr><tr><td><p>Port</p></td><td><p>Removed</p></td><td><p>The port is taken from the Http Configuration in <strong>Listener Config</strong></p></td></tr><tr><td><p>Client Store Ref</p></td><td><p>Changed</p></td><td><p>The attribute is now an Object Store. Needs to be a ref or an Private Object Store definition</p></td></tr><tr><td><p>Authorization Code Store Ref</p></td><td><p>Moved, Changed</p></td><td><p>The authorization code store should now be configured as an attribute of <strong>Authorization Config</strong> and it should be an Object Store</p></td></tr><tr><td><p>Token Generator Strategy</p></td><td><p>Kept</p></td><td><p>Token Generator Strategy</p></td></tr><tr><td><p>Token Store Ref</p></td><td><p>Moved, Changed</p></td><td><p>The token store should now be configured as an attribute of <strong>Token Config</strong> and it should be an Object Store</p></td></tr><tr><td><p>Login Page</p></td><td><p>Moved</p></td><td><p>The login page is configured as an attribute of <strong>Authorization Config</strong></p></td></tr><tr><td><p>Scopes</p></td><td><p>Kept</p></td><td><p>Should now be comma separated</p></td></tr><tr><td><p>Default Scopes</p></td><td><p>Kept</p></td><td><p>Should now be comma separated</p></td></tr><tr><td><p>Supported Grant Types</p></td><td><p>Kept</p></td><td><p>Should now be comma separated</p></td></tr><tr><td><p>Authorization Endpoint Path</p></td><td><p>Changed, Moved</p></td><td><p>Configurable in the attribute <em>path</em> of <strong>Authorization Config</strong></p></td></tr><tr><td><p>Access Token Endpoint Path</p></td><td><p>Changed, Moved</p></td><td><p>Configurable in the attribute <em>path</em> of <strong>Token Config</strong></p></td></tr><tr><td><p>Authorization Ttl Seconds</p></td><td><p>Removed</p></td><td><p>The authorization code Ttl will be taken from the entry Ttl configured in the <strong>Authorization Code Store</strong> object store.</p></td></tr><tr><td><p>Token Ttl Seconds</p></td><td><p>Moved, Changed</p></td><td><p>The token Ttl will be taken from the <strong>Token Store</strong> object store. Due to a limitation in the code, it is asked that the field is also configured in the attributes <em>tokenTtl</em> and <em>tokenTtlTimeUnit</em> of <strong>TokenConfig</strong>. The <strong>Token Store</strong> <em>entryTtl</em> and <strong>Token Config</strong> <em>tokenTtl</em> (and <em>tokenTtlTimeUnit</em>) must be the same.</p></td></tr><tr><td><p>Refresh Token Ttl Seconds</p></td><td><p>Removed</p></td><td><p>The refresh token Ttl will be taken from the entry Ttl of the Object Store configured in the <strong>Refresh Token Strategy</strong> in case there is one.</p></td></tr><tr><td><p>Connector</p></td><td><p>Removed</p></td><td><p>Transports were removed from Mule 4 so this field has no meaning anymore.</p></td></tr><tr><td><p>HttpListenerConfig</p></td><td><p>Changed</p></td><td><p>Now it’s called <strong>Listener Config</strong> and it’s mandatory</p></td></tr><tr><td><p>Resource Owner Security Provider Ref</p></td><td><p>Changed</p></td><td><p><strong>Ref</strong> has been removed from the attribute’s name. The Spring Module should be used if a Spring Security Provider is configured.</p></td></tr><tr><td><p>Client Security Provider Ref</p></td><td><p>Changed</p></td><td><p><strong>Ref</strong> has been removed from the attribute’s name. The Spring Module should be used if a Spring Security Provider is configured.</p></td></tr><tr><td><p>Enable Refresh Token</p></td><td><p>Removed</p></td><td><p>Configurable with a different <strong>Refresh Token Strategy</strong></p></td></tr><tr><td><p>Issue New Refresh Token</p></td><td><p>Removed</p></td><td><p>Configurable with a different <strong>Refresh Token Strategy</strong></p></td></tr><tr><td><p>Rate Limiter</p></td><td><p>Changed</p></td><td><p>You can no longer add a custom implementation from a spring bean. Only Period Rate Limiter is implemented for now.</p></td></tr><tr><td><p>Clients</p></td><td><p>Kept</p></td><td><p>Each client definition changed</p></td></tr><tr><td><p>Pre Flow</p></td><td><p>Removed</p></td><td><p>Pre flow functionality will not be supported in this version</p></td></tr></tbody></table>

## Stores

Authentication Code, Token or Refresh token stores no longer exist and there is no attribute that
lets you reference a custom implementation of any of those. Any storage configuration is now done
with an Object Store.

If a custom behavior is needed, then a custom implementation of an Object Store should be used to
configure any of those attributes

## Security Providers

In Mule 4 we decoupled the applications configuration completely from Spring, so for some of the
attributes that were configured by referencing a Spring Bean, the way of configuring them has
changed.

Spring security providers can still be used but, in that case, the Spring Module is needed in order
for the application to work.

## Refresh Token Attributes

In Mule 3, there were 2 attributes that allowed the refresh token behavior configuration. As now we
have different Refresh Token Strategies, the configuration should be done the following way.

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p><strong>Enable Refresh Token</strong></p></td><td><p><strong>Issue New Refresh Token</strong></p></td><td><p><strong>Refresh Token Strategy</strong></p></td></tr><tr><td><p>False</p></td><td><p>-</p></td><td><p>No Refresh Token Strategy</p></td></tr><tr><td><p>True</p></td><td><p>False</p></td><td><p>Single Refresh Token Strategy</p></td></tr><tr><td><p>True</p></td><td><p>True</p></td><td><p>Multiple Refresh Token Strategy</p></td></tr></tbody></table>

## Clients

In both Mule versions you have the possibility to define a list of clients that will be authorized
to make requests to the Authentication Server.

The way to add the clients remains the same except for some attribute names. Due to a limitation in
the new version, the names of the child elements had to be changed by adding the _clients_ and
_client_ prefixes.

- Redirect Uri(s) → Client Redirect Uris(s)

- Authorized Grant Type(s) → Client Authorized Grant Type(s)

- Scope(s) → Client Scope(s)

## Operations

The following are the operations available in the module for Mule 3 and the changes they have for
Mule 4

### Validate Client

The operation was removed in Mule 4.

### Validate

Now the operation is called **Validate Token**.

Since the OAuth2 Provider operations are no longer linked to HTTP, an expression to resolve the
token to validate is required.

In Mule 3, after token validation, if there was a resource owner authentication involved, a new
security context was created with that resource owner authentication. Also, the token holder with
the token information was saved in a flow variable called:
_mule.oauth2.access\_token\_store\_holder_.  
Now, in Mule 4, that same information is saved a little bit differently. After token validation, the
security context will be created with a token authentication accessible by `#[authentication]`. The
token holder that was in a variable is saved as an attribute of that token authentication :
`#[authentication.tokenHolder]`. At the same time, if there was a resource owner involved, it
information can be reached by evaluating `#[authentication.tokenHolder.resourceOwnerAuthentication]`

### Create Client

The operation remains the same except for a new attribute that was added: **Fail If Present**.

**Fail If Present** lets you decide what to do if a client with the same id of the one to be added
already exists.

- If true, the operation will fail

- If false, the client information will be updated

### Delete Client

The operation remains the same.

### Revoke Token

The operation remains the same.

## Example

Here is an example of the same application configured in Mule 3 And Mule 4.

The application has an OAuth2 Provider that grants tokens and a flow that listens to HTTP requests
and has a token validation before processing some logic.

Keep in mind that the Mule 4 configuration is using the Spring Module and the Object Store
Connector.

In both cases the application has been split into multiple files.

For Mule 3 there are 2: One for common configuration and another one for the actual OAuth2 Provider
configuration.  
For Mule 4 there are 3 files: One for bean definition, one for common configuration and one for the
actual OAuth2 Provider configuration.

### Mule 3

#### Common configuration

```xml
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:mule-ss="http://www.mulesoft.org/schema/mule/spring-security"
    xmlns:ss="http://www.springframework.org/schema/security"
    xmlns:spring="http://www.springframework.org/schema/beans"
    xmlns:p="http://www.springframework.org/schema/p"
    xsi:schemaLocation="
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/spring-security http://www.mulesoft.org/schema/mule/spring-security/current/mule-spring-security.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <global-property name="allSupportedGrantTypes"
                     value="AUTHORIZATION_CODE IMPLICIT RESOURCE_OWNER_PASSWORD_CREDENTIALS CLIENT_CREDENTIALS" />

    <spring:beans>
        <spring:bean name="rateLimiter"
                     class="org.mule.modules.oauth2.provider.ratelimit.SimpleInMemoryRateLimiter" />

        <spring:bean name="clientObjectStore"
                     class="org.mule.util.store.InMemoryObjectStore" />
        <spring:bean name="authorizationCodeObjectStore"
                     class="org.mule.util.store.InMemoryObjectStore" />
        <spring:bean name="tokenObjectStore"
                     class="org.mule.util.store.InMemoryObjectStore" />
        <spring:bean name="refreshTokenObjectStore"
                     class="org.mule.util.store.InMemoryObjectStore" />

        <spring:bean name="clientStore"
                     class="org.mule.modules.oauth2.provider.client.ObjectStoreClientStore"
                     p:objectStore-ref="clientObjectStore" />

        <spring:bean name="tokenStore"
                     class="org.mule.modules.oauth2.provider.token.ObjectStoreTokenStore"
                     p:refreshTokenObjectStore-ref="refreshTokenObjectStore"
                     p:accessTokenObjectStore-ref="tokenObjectStore"/>

        <spring:bean name="authorizationCodeStore"
                     class="org.mule.modules.oauth2.provider.code.ObjectStoreAuthorizationCode"
                     p:objectStore-ref="authorizationCodeObjectStore" />

        <ss:authentication-manager id="resourceOwnerAuthenticationManager">
            <ss:authentication-provider>
                <ss:user-service id="resourceOwnerUserService">
                    <ss:user name="rousr"
                             password="ropwd+%"
                             authorities="RESOURCE_OWNER" />
                </ss:user-service>
            </ss:authentication-provider>
        </ss:authentication-manager>

        <ss:authentication-manager id="clientAuthenticationManager">
            <ss:authentication-provider>
                <ss:user-service id="clientUserService">
                    <ss:user name="clusr"
                             password="clpwd+%"
                             authorities="CLIENT" />
                </ss:user-service>
            </ss:authentication-provider>
        </ss:authentication-manager>
    </spring:beans>

    <mule-ss:security-manager>
        <mule-ss:delegate-security-provider
            name="resourceOwnerSecurityProvider"
            delegate-ref="resourceOwnerAuthenticationManager" />
        <mule-ss:delegate-security-provider
            name="clientSecurityProvider"
            delegate-ref="clientAuthenticationManager" />
    </mule-ss:security-manager>
</mule>
```

#### Application configuration

```xml
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:oauth2-provider="http://www.mulesoft.org/schema/mule/oauth2-provider"
      xmlns:http="http://www.mulesoft.org/schema/mule/http"
      xsi:schemaLocation=
        "http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd">

    <oauth2-provider:config name="OAuth2Provider"
                            providerName="Test OAuth2Provider"
                            loginPage="static/auth.html"
                            authorizationEndpointPath="authorize"
                            accessTokenEndpointPath="token"
                            host="localhost"
                            port="8081"
                            resourceOwnerSecurityProvider-ref="resourceOwnerSecurityProvider"
                            clientSecurityProvider-ref="clientSecurityProvider"
                            clientStore-ref="clientStore"
                            tokenStore-ref="tokenStore"
                            authorizationCodeStore-ref="authorizationCodeStore"
                            rateLimiter-ref="rateLimiter"
                            scopes="GUEST USER ADMIN"
                            defaultScopes="USER"
                            supportedGrantTypes="${allSupportedGrantTypes}"
                            authorizationTtlSeconds="600"
                            tokenTtlSeconds="86400"
                            refreshTokenTtlSeconds="-1"
                            enableRefreshToken="true"
                            issueNewRefreshToken="true">

        <oauth2-provider:clients>
            <oauth2-provider:client clientId="clientId1"
                                    secret="clientSecret1"
                                    principal="clusr"
                                    type="CONFIDENTIAL">
                <oauth2-provider:redirect-uris>
                    <oauth2-provider:redirect-uri>
                        http://fake/redirect
                    </oauth2-provider:redirect-uri>
                </oauth2-provider:redirect-uris>
                <oauth2-provider:authorized-grant-types>
                    <oauth2-provider:authorized-grant-type>
                        AUTHORIZATION_CODE
                    </oauth2-provider:authorized-grant-type>
                </oauth2-provider:authorized-grant-types>
            </oauth2-provider:client>
        </oauth2-provider:clients>
    </oauth2-provider:config>

    <flow name="protected-resource-flow">
        <http:inbound-endpoint host="localhost"
                               port="8081"
                               path="protected"/>
        <oauth2-provider:validate />
        <flow-ref name="additionalLogic"/>
    </flow>

</mule>
```

### Mule 4

#### Bean Configuration

```xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:ss="http://www.springframework.org/schema/security"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-{version}.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-{version}.xsd">

        <ss:authentication-manager id="resourceOwnerAuthenticationManager">
            <ss:authentication-provider>
                <ss:user-service id="resourceOwnerUserService">
                    <ss:user name="rousr"
                             password="ropwd+%"
                             authorities="RESOURCE_OWNER" />
                </ss:user-service>
            </ss:authentication-provider>
        </ss:authentication-manager>

        <ss:authentication-manager id="clientAuthenticationManager">
            <ss:authentication-provider>
                <ss:user-service id="clientUserService">
                    <ss:user name="clusr"
                             password="clpwd+%"
                             authorities="CLIENT" />
                </ss:user-service>
            </ss:authentication-provider>
        </ss:authentication-manager>
</beans>
```

#### Common Configuration

```xml
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:spring="http://www.mulesoft.org/schema/mule/spring"
      xmlns:os="http://www.mulesoft.org/schema/mule/os"

      xsi:schemaLocation="
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/spring http://www.mulesoft.org/schema/mule/spring/current/mule-spring.xsd
        http://www.mulesoft.org/schema/mule/os http://www.mulesoft.org/schema/mule/os/current/mule-os.xsd">

    <spring:config name="springConfig" files="common-config-beans.xml"/>

    <global-property name="allSupportedGrantTypes" value="AUTHORIZATION_CODE,IMPLICIT,RESOURCE_OWNER_PASSWORD_CREDENTIALS,CLIENT_CREDENTIALS"/>

    <os:object-store name="clientObjectStore"
                     persistent="true"/>
    <os:object-store name="authorizationCodeObjectStore"
                     entryTtl="600"
                     entryTtlUnit="SECONDS"
                     persistent="true"/>
    <os:object-store name="tokenObjectStore"
                     entryTtl="86400"
                     entryTtlUnit="SECONDS"
                     persistent="true"/>

    <spring:security-manager>
        <spring:delegate-security-provider name="clientSecurityProvider"
                                           delegate-ref="clientAuthenticationManager"/>
        <spring:delegate-security-provider name="resourceOwnerSecurityProvider"
                                           delegate-ref="resourceOwnerAuthenticationManager"/>
    </spring:security-manager>

</mule>
```

#### Application Configuration

```xml
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:oauth2-provider="http://www.mulesoft.org/schema/mule/oauth2-provider"
      xmlns:http="http://www.mulesoft.org/schema/mule/http"
      xsi:schemaLocation="
        http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd">

    <http:listener-config name="listenerConfig">
        <http:listener-connection host="localhost"
                                  port="8081"/>
    </http:listener-config>

    <oauth2-provider:config name="OAuth2Provider"
                            providerName="Test OAuth2Provider"
                            resourceOwnerSecurityProvider="resourceOwnerSecurityProvider"
                            clientSecurityProvider="clientSecurityProvider"
                            supportedGrantTypes="${allSupportedGrantTypes}"
                            listenerConfig="listenerConfig"
                            clientStore="clientObjectStore"
                            scopes="GUEST,USER,ADMIN"
                            defaultScopes="USER"
                            supportedGrantTypes="${allSupportedGrantTypes}">
        <oauth2-provider:client-validation-rate-limiter>
            <oauth2-provider:period-rate-limiter/>
        </oauth2-provider:client-validation-rate-limiter>
        <oauth2-provider:token-config path="/token"
                                      tokenStore="tokenObjectStore"
                                      tokenTtl="86400"
                                      tokenTtlTimeUnit="SECONDS">
            <oauth2-provider:refresh-token-strategy>
                <oauth2-provider:multiple-refresh-tokens/>
            </oauth2-provider:refresh-token-strategy>
        </oauth2-provider:token-config>
        <oauth2-provider:authorization-config loginPage="static/auth.html"
                                              path="/authorize"
                                              authorizationCodeStore="authorizationCodeObjectStore"/>
        <oauth2-provider:clients>
            <oauth2-provider:client clientId="clientId1"
                                    secret="clientSecret1"
                                    principal="clusr"
                                    type="CONFIDENTIAL">
                <oauth2-provider:client-redirect-uris>
                    <oauth2-provider:client-redirect-uri>
                        http://fake/redirect
                    </oauth2-provider:client-redirect-uri>
                </oauth2-provider:client-redirect-uris>
                <oauth2-provider:client-authorized-grant-types>
                    <oauth2-provider:client-authorized-grant-type>
                        AUTHORIZATION_CODE
                    </oauth2-provider:client-authorized-grant-type>
                </oauth2-provider:client-authorized-grant-types>
            </oauth2-provider:client>
        </oauth2-provider:clients>
    </oauth2-provider:config>


    <flow name="protected-resource-flow">
        <http:listener path="/protected" config-ref="listenerConfig"/>
        <oauth2-provider:validate-token config-ref="OAuth2Provider"/>
        <flow-ref name="additionalLogic"/>
    </flow>

</mule>
```

## See Also

- [OAuth2 Provider Documentation Reference](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)