# mulesoft OAuth2 Provider Module - Full Documentation --- product: OAuth2 Provider Module version: 1.0 --- # OAuth2 Provider Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt OAuth2 Provider Module v1.0 The OAuth2 Provider module enables a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application can authenticate to previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. The following documentation assumes a basic knowledge of the OAuth2 authorization protocol. For further reference, see the [RFC-6749](https://datatracker.ietf.org/doc/html/rfc6749). If the app behaves as the client in the OAuth2 dance, use the [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/) instead. ## Before You Begin To use this module, you must be familiar with: - Anypoint Connectors - Mule runtime engine (Mule) - Elements and global elements in a Mule flow - Creating a Mule app using Anypoint Studio or Anypoint Code Builder ## Using Exchange Templates and Examples [Anypoint Exchange](https://www.mulesoft.com/exchange/) provides templates that you can use as starting points for your apps and examples that illustrate a complete solution. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.1 --- # OAuth2 Provider Module 1.1 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module enables a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application can authenticate to previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. The following documentation assumes a basic knowledge of the OAuth2 authorization protocol. For further reference, see the [RFC-6749](https://datatracker.ietf.org/doc/html/rfc6749). If the app behaves as the client in the OAuth2 dance, use the [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/) instead. ## Before You Begin To use this module, you must be familiar with: - Anypoint Connectors - Mule runtime engine (Mule) - Elements and global elements in a Mule flow - Creating a Mule app using Anypoint Studio or Anypoint Code Builder ## Using Exchange Templates and Examples [Anypoint Exchange](https://www.mulesoft.com/exchange/) provides templates that you can use as starting points for your apps and examples that illustrate a complete solution. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.1 --- # OAuth2 Provider Module 1.1 Reference > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. ## Configurations --- ### Default Configuration OAuth2 Provider module configuration #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

The name for this configuration. Connectors reference the configuration with this name.

x

Provider Name

String

The provider name supplied to customers of the API. This is used for some responses of the OAuth2 API.

Listener Config

String

The name of an HTTP Listener Config to reference, which handles the token and authorization endpoints.

x

Client Validation Rate Limiter

The rate limiter used to control access to certain operations. If none is specified, PeriodRateLimiter is used as the default.

Client Store

Object Store

A store that allows retrieving client configuration information, like their secret. If no client store is provided, a default in memory object store is configured.

Resource Owner Security Provider

String

The security provider used to authenticate resource owners. Not needed if only the CLIENT_CREDENTIALS grant type is used. Refer to an example with Spring module in migrating the OAuth2 provider documentation.

Client Security Provider

String

The security provider used to authenticate clients. Not needed if only public clients or private clients with secrets are used

Token Generator Strategy

TokenGeneratorStrategy

The strategy used to generate access tokens. Should reference a class that implements TokenGeneratorStrategy.

Supported Grant Types

Enumeration, list of:

  • AUTHORIZATION_CODE

  • IMPLICIT

  • RESOURCE_OWNER_PASSWORD_CREDENTIALS

  • CLIENT_CREDENTIALS

The comma-separated grant types this provider supports. If none specified, only the authorization code grant type is supported.

AUTHORIZATION_CODE

Scopes

String

A comma-separated list of supported scopes.

Default Scopes

String

A comma-separated list of the default scopes a client should have if none is defined.

Token Config

Information for configuring token related behavior.

Authorization Config

Information for configuring authorization handling behavior

Clients

Array of Client

A list of clients.

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the platform expires the instance at the exact moment that it becomes eligible. Mule purges the instances as appropriate.

## Operations - [Create Client](#createClient) - [Delete Client](#deleteClient) - [Revoke Token](#revokeToken) - [Validate Token](#validateToken) ### Create Client `` Creates a new client and saves it in the configured client store. ```xml ``` #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID to assign to the created client.

x

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The type of the client. Allowed values are PUBLIC: Clients incapable of maintaining the confidentiality of their credentials, or CONFIDENTIAL: Clients capable of maintaining the confidentiality of their credentials.

PUBLIC

Secret

String

Client Name

String

A friendly name for the client.

Description

String

A brief description of the client.

Principal

String

An optional principal to use when the ID can’t be used with the security provider.

Redirect Uris

Array of String

An expression that resolves to a list of redirect URIs used for when the client makes requests to the OAuth Provider.

Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

An expression that resolves to a list of the authorized grant types that the client can use to request a token.

Scopes

Array of String

An expression that resolves to a list of supported scopes by the client. If none are provided, the default scopes of the General Configuration are used.

Fail If Present

Boolean

Defines what to do if a client with the same ID is already registered. If true, an error is raised. Otherwise, the client is updated.

false

### For Configurations [Default Configuration](#config) #### Throws - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS - If a client already exists with the same client ID, and **Fail If Present** is set to `true`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION - If the provided parameters are not valid, such as having **Authorized Grant Types** of AUTHORIZATION\_CODE but without a redirect URI. ### Delete Client `` Deletes a client from the store. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID of the client to be deleted.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:NO\_SUCH\_CLIENT - The client to be deleted does not exist. ### Revoke Token `` Revokes an access token or refresh token, invalidating the related refresh token or access token as well. If client credentials need to be validated, use the validateClient credential before revoking the token. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Token

String

The token to revoke, it can be an access token or a refresh token.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:INVALID\_TOKEN - The token to be revoked is not valid. ### Validate Token `` Checks that a valid access token is provided. Validates that the given token was granted and is in a valid state. Also, if defined, checks that the token scopes or resource owner roles match the provided ones. If the provided token is valid, the operation sets the payload as a JSON with the following information: - expires\_in: Time remaining for the token to be considered invalid, in seconds. - scope: Space separated scopes associated with the token. - client\_id: ID of the client that requested this token. - username: Username of the resource owner that authorized this token to be requested. To preserve the payload set before executing the operation, you can use the `target` and `targetValue` attributes to set the JSON information in a variable instead of overwriting the payload. Validate Token parameters: #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of the configuration to use.

x

Access Token

String

#[(attributes.headers['authorization'] splitBy ' ')[1]]

Scopes

Array of String

An expression that resolves to a list of scopes to enforce when validating the token.

Resource Owner Roles

Array of String

The resource owner roles to enforce when validating the token. This is an expression that resolves to a list of resource owner roles to enforce when validating the token.

Target Variable

String

The name of a variable to store the operation’s output.

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

#### Output

Type

String

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED - The token being validated is not valid. ## Types ### Token Configuration Configuration related to token handling and the token endpoint.
FieldTypeDescriptionDefault ValueRequired

Path

String

Endpoint to call when wanting to request a new token

/token

Token Store

Object Store

ObjectStore configuration information for storing token related data

Refresh Token Strategy

The refresh token strategy to use. By default no refresh token should be generated

Token Ttl

Number

The time in seconds before an access token code expires.

86400

Token Ttl Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

The time unit for the token ttl.

SECONDS

### Authorization Config Configuration related to authorization code handling and the authorization endpoint.
FieldTypeDescriptionDefault ValueRequired

Login Page

String

Relative file path to the web page for the resource owner to provide its credentials.
Keep in mind that if the default page is not used, you need to handle any external files referenced in the configured HTML. They are not handled by the OAuth provider.
For example, if the login page HTML references an external .css style file, an endpoint that provides that file must exist. See HTTP Load Static Resource.

www-static/auth.html

Path

String

The URL relative path to the authorization endpoint in the HTTP server for listening to authorization requests.

/authorize

Authorization Code Store

Object Store

A reference to a globally defined object store or a definition of a private object store. It’s used to store generated authorization codes.

A persistent object store created from the ObjectStoreManager with an entry TTL of 600 SECONDS.

### Client All registered clients are authorized to request tokens. The list can be modified in runtime by the [Create Client](#createClient) and [Delete Client](#deleteClient) operations. ```xml ``` Each registered client has an entry with the following information:
FieldTypeDescriptionDefault ValueRequired

Client Id

String

A unique ID that will used to reference the client

x

Principal

String

An optional principal to use when the ID can’t be used with the security provider. For some security providers, the clientId can’t be used for the client username. In those cases, the client’s principal is used for authentication.

Client Name

String

The name of the client

Description

String

A short description for the client

Secret

String

A client secret used to authenticate the client. Only required if Type is CONFIDENTIAL.

Client Redirect Uris

Array of String

List of registered redirect URIs to use to respond to the client once the request is processed.

Most requests allow the definition of new redirection URIs so these are not always taken into account. See also New Value Handling.

<oauth2-provider:client-scope value="USER"/>

Client Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

The grant types that define which OAuth flows this client will be able to be successfully execute to get a token. See also New Value Handling.

Client Scopes

Array of String

The scopes that will match this client. If a request is received with a matching client ID but with different scopes, it will not be processed. See also New Value Handling.

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The client type defines if the client is able to maintain confidentiality for its credentials. Allowed values are PUBLIC, where clients do not maintain the confidentiality of their credentials, or CONFIDENTIAL, where clients maintain the confidentiality of their credentials.

PUBLIC

For client redirect URIs, client authorized grant types, or client scopes, give each new value a new XML tag: `` `` ### Expiration Policy
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

A scalar time value for the maximum amount of time a dynamic configuration instance should be allowed to be idle before it’s considered eligible for expiration

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

A time unit that qualifies the maxIdleTime attribute

### No Refresh Token No refresh token is granted with every access token. As a consequence, when a refresh token request comes, it is always rejected.
FieldTypeDescriptionDefault ValueRequired

Token Generator Strategy

TokenGeneratorStrategy

### Single Refresh Token For every new access token that is granted, a single refresh token is associated with it. That same refresh token can be used every time the access token is refreshed.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store or a definition of a private object store for storing generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Multiple Refresh Tokens A new refresh token is generated every time a refresh token request is executed. After that, the previous refresh token is invalidated.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store, or a definition of a private object store that stores the generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Period Rate Limiter Period Rate Limiter handles rate limiting based on a time period. You can configure a mechanism to prevent the continuous client validation when it’s using invalid credentials.
FieldTypeDescriptionDefault ValueRequired

Duration

Number

The time to wait before resetting the rate limiter. That means that during time intervals of duration length, every time a client validation fails, it will be added to the failure count.

600

Duration Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

SECONDS

Maximum Failure Count

Number

Maximum number of failures allowed within the period before preemptively rejecting requests.

5

## OAuth Dance Because the OAuth dance is done through HTTP, the OAuth2 Provider makes use of the [Mule HTTP Connector](https://docs.mulesoft.com/http-connector/latest/). As a consequence, apart from the definition of an OAuth2 provider configuration, the Mule application must also have an HTTP Listener configuration to be used by the provider. Once configured, the provider works as follows: Two HTTP endpoints are created for listening to Authentication Code and Token request as stated by the OAuth2 definition. Those work independently from the Mule application and respond via HTTP. The provider defines an operation: [Validate Token](#validateToken) that can check if a token is authorized. That operation can be added anywhere in a flow to control its execution. If the token is indeed authorized, the flow continues executing, setting token information in the payload; otherwise, a `TOKEN_UNAUTHORIZED` error is raised. You need to add the operation to the parts of the application that require token authorization. Since token validation is almost always used together with an HTTP Listener, in case it fails, the Listener’s response mechanism can handle the error and properly respond to the requester. Additional logic can be added for handling that type of error. Lastly, additional operations are provided to add or delete clients and to revoke tokens if needed. ## Security Providers As seen in the [General Configuration](#general-configuration), two security providers should be defined in the app to be later referenced by the OAuth2 Configuration element. One way of doing this is using the Spring Framework, defining both security providers, and then using the [Spring Module](https://docs.mulesoft.com/spring-module/latest/) to add the providers to the Mule Security Manager: ```xml ``` ## General Configuration ```xml ``` ## See Also [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.2 is-latest-version: true --- # OAuth2 Provider Module 1.2 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module enables a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application can authenticate to previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. The following documentation assumes a basic knowledge of the OAuth2 authorization protocol. For further reference, see the [RFC-6749](https://datatracker.ietf.org/doc/html/rfc6749). If the app behaves as the client in the OAuth2 dance, use the [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/) instead. ## Before You Begin To use this module, you must be familiar with: - Anypoint Connectors - Mule runtime engine (Mule) - Elements and global elements in a Mule flow - Creating a Mule app using Anypoint Studio or Anypoint Code Builder ## Using Exchange Templates and Examples [Anypoint Exchange](https://www.mulesoft.com/exchange/) provides templates that you can use as starting points for your apps and examples that illustrate a complete solution. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.2 is-latest-version: true --- # OAuth2 Provider Module 1.2 Reference > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. ## Configurations --- ### Default Configuration OAuth2 Provider module configuration #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

The name for this configuration. Connectors reference the configuration with this name.

x

Provider Name

String

The provider name supplied to customers of the API. This is used for some responses of the OAuth2 API.

Listener Config

String

The name of an HTTP Listener Config to reference, which handles the token and authorization endpoints.

x

Client Validation Rate Limiter

The rate limiter used to control access to certain operations. If none is specified, PeriodRateLimiter is used as the default.

Client Store

Object Store

A store that allows retrieving client configuration information, like their secret. If no client store is provided, a default in memory object store is configured.

Resource Owner Security Provider

String

The security provider used to authenticate resource owners. Not needed if only the CLIENT_CREDENTIALS grant type is used. Refer to an example with Spring module in migrating the OAuth2 provider documentation.

Client Security Provider

String

The security provider used to authenticate clients. Not needed if only public clients or private clients with secrets are used

Token Generator Strategy

TokenGeneratorStrategy

The strategy used to generate access tokens. Should reference a class that implements TokenGeneratorStrategy.

Supported Grant Types

Enumeration, list of:

  • AUTHORIZATION_CODE

  • IMPLICIT

  • RESOURCE_OWNER_PASSWORD_CREDENTIALS

  • CLIENT_CREDENTIALS

The comma-separated grant types this provider supports. If none specified, only the authorization code grant type is supported.

AUTHORIZATION_CODE

Scopes

String

A comma-separated list of supported scopes.

Default Scopes

String

A comma-separated list of the default scopes a client should have if none is defined.

Token Config

Information for configuring token related behavior.

Authorization Config

Information for configuring authorization handling behavior

Clients

Array of Client

A list of clients.

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the platform expires the instance at the exact moment that it becomes eligible. Mule purges the instances as appropriate.

## Operations - [Create Client](#createClient) - [Delete Client](#deleteClient) - [Revoke Token](#revokeToken) - [Validate Token](#validateToken) ### Create Client `` Creates a new client and saves it in the configured client store. ```xml ``` #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID to assign to the created client.

x

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The type of the client. Allowed values are PUBLIC: Clients incapable of maintaining the confidentiality of their credentials, or CONFIDENTIAL: Clients capable of maintaining the confidentiality of their credentials.

PUBLIC

Secret

String

Client Name

String

A friendly name for the client.

Description

String

A brief description of the client.

Principal

String

An optional principal to use when the ID can’t be used with the security provider.

Redirect Uris

Array of String

An expression that resolves to a list of redirect URIs used for when the client makes requests to the OAuth Provider.

Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

An expression that resolves to a list of the authorized grant types that the client can use to request a token.

Scopes

Array of String

An expression that resolves to a list of supported scopes by the client. If none are provided, the default scopes of the General Configuration are used.

Fail If Present

Boolean

Defines what to do if a client with the same ID is already registered. If true, an error is raised. Otherwise, the client is updated.

false

### For Configurations [Default Configuration](#config) #### Throws - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS - If a client already exists with the same client ID, and **Fail If Present** is set to `true`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION - If the provided parameters are not valid, such as having **Authorized Grant Types** of AUTHORIZATION\_CODE but without a redirect URI. ### Delete Client `` Deletes a client from the store. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID of the client to be deleted.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:NO\_SUCH\_CLIENT - The client to be deleted does not exist. ### Revoke Token `` Revokes an access token or refresh token, invalidating the related refresh token or access token as well. If client credentials need to be validated, use the validateClient credential before revoking the token. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Token

String

The token to revoke, it can be an access token or a refresh token.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:INVALID\_TOKEN - The token to be revoked is not valid. ### Validate Token `` Checks that a valid access token is provided. Validates that the given token was granted and is in a valid state. Also, if defined, checks that the token scopes or resource owner roles match the provided ones. If the provided token is valid, the operation sets the payload as a JSON with the following information: - expires\_in: Time remaining for the token to be considered invalid, in seconds. - scope: Space separated scopes associated with the token. - client\_id: ID of the client that requested this token. - username: Username of the resource owner that authorized this token to be requested. To preserve the payload set before executing the operation, you can use the `target` and `targetValue` attributes to set the JSON information in a variable instead of overwriting the payload. Validate Token parameters: #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of the configuration to use.

x

Access Token

String

#[(attributes.headers['authorization'] splitBy ' ')[1]]

Scopes

Array of String

An expression that resolves to a list of scopes to enforce when validating the token.

Resource Owner Roles

Array of String

The resource owner roles to enforce when validating the token. This is an expression that resolves to a list of resource owner roles to enforce when validating the token.

Target Variable

String

The name of a variable to store the operation’s output.

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

#### Output

Type

String

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED - The token being validated is not valid. ## Types ### Token Configuration Configuration related to token handling and the token endpoint.
FieldTypeDescriptionDefault ValueRequired

Path

String

Endpoint to call when wanting to request a new token

/token

Token Store

Object Store

ObjectStore configuration information for storing token related data

Refresh Token Strategy

The refresh token strategy to use. By default no refresh token should be generated

Token Ttl

Number

The time in seconds before an access token code expires.

86400

Token Ttl Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

The time unit for the token ttl.

SECONDS

### Authorization Config Configuration related to authorization code handling and the authorization endpoint.
FieldTypeDescriptionDefault ValueRequired

Login Page

String

Relative file path to the web page for the resource owner to provide its credentials.
Keep in mind that if the default page is not used, you need to handle any external files referenced in the configured HTML. They are not handled by the OAuth provider.
For example, if the login page HTML references an external .css style file, an endpoint that provides that file must exist. See HTTP Load Static Resource.

www-static/auth.html

Path

String

The URL relative path to the authorization endpoint in the HTTP server for listening to authorization requests.

/authorize

Authorization Code Store

Object Store

A reference to a globally defined object store or a definition of a private object store. It’s used to store generated authorization codes.

A persistent object store created from the ObjectStoreManager with an entry TTL of 600 SECONDS.

### Client All registered clients are authorized to request tokens. The list can be modified in runtime by the [Create Client](#createClient) and [Delete Client](#deleteClient) operations. ```xml ``` Each registered client has an entry with the following information:
FieldTypeDescriptionDefault ValueRequired

Client Id

String

A unique ID that will used to reference the client

x

Principal

String

An optional principal to use when the ID can’t be used with the security provider. For some security providers, the clientId can’t be used for the client username. In those cases, the client’s principal is used for authentication.

Client Name

String

The name of the client

Description

String

A short description for the client

Secret

String

A client secret used to authenticate the client. Only required if Type is CONFIDENTIAL.

Client Redirect Uris

Array of String

List of registered redirect URIs to use to respond to the client once the request is processed.

Most requests allow the definition of new redirection URIs so these are not always taken into account. See also New Value Handling.

<oauth2-provider:client-scope value="USER"/>

Client Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

The grant types that define which OAuth flows this client will be able to be successfully execute to get a token. See also New Value Handling.

Client Scopes

Array of String

The scopes that will match this client. If a request is received with a matching client ID but with different scopes, it will not be processed. See also New Value Handling.

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The client type defines if the client is able to maintain confidentiality for its credentials. Allowed values are PUBLIC, where clients do not maintain the confidentiality of their credentials, or CONFIDENTIAL, where clients maintain the confidentiality of their credentials.

PUBLIC

For client redirect URIs, client authorized grant types, or client scopes, give each new value a new XML tag: `` `` ### Expiration Policy
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

A scalar time value for the maximum amount of time a dynamic configuration instance should be allowed to be idle before it’s considered eligible for expiration

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

A time unit that qualifies the maxIdleTime attribute

### No Refresh Token No refresh token is granted with every access token. As a consequence, when a refresh token request comes, it is always rejected.
FieldTypeDescriptionDefault ValueRequired

Token Generator Strategy

TokenGeneratorStrategy

### Single Refresh Token For every new access token that is granted, a single refresh token is associated with it. That same refresh token can be used every time the access token is refreshed.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store or a definition of a private object store for storing generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Multiple Refresh Tokens A new refresh token is generated every time a refresh token request is executed. After that, the previous refresh token is invalidated.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store, or a definition of a private object store that stores the generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Period Rate Limiter Period Rate Limiter handles rate limiting based on a time period. You can configure a mechanism to prevent the continuous client validation when it’s using invalid credentials.
FieldTypeDescriptionDefault ValueRequired

Duration

Number

The time to wait before resetting the rate limiter. That means that during time intervals of duration length, every time a client validation fails, it will be added to the failure count.

600

Duration Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

SECONDS

Maximum Failure Count

Number

Maximum number of failures allowed within the period before preemptively rejecting requests.

5

## OAuth Dance Because the OAuth dance is done through HTTP, the OAuth2 Provider makes use of the [Mule HTTP Connector](https://docs.mulesoft.com/http-connector/latest/). As a consequence, apart from the definition of an OAuth2 provider configuration, the Mule application must also have an HTTP Listener configuration to be used by the provider. Once configured, the provider works as follows: Two HTTP endpoints are created for listening to Authentication Code and Token request as stated by the OAuth2 definition. Those work independently from the Mule application and respond via HTTP. The provider defines an operation: [Validate Token](#validateToken) that can check if a token is authorized. That operation can be added anywhere in a flow to control its execution. If the token is indeed authorized, the flow continues executing, setting token information in the payload; otherwise, a `TOKEN_UNAUTHORIZED` error is raised. You need to add the operation to the parts of the application that require token authorization. Since token validation is almost always used together with an HTTP Listener, in case it fails, the Listener’s response mechanism can handle the error and properly respond to the requester. Additional logic can be added for handling that type of error. Lastly, additional operations are provided to add or delete clients and to revoke tokens if needed. ## Security Providers As seen in the [General Configuration](#general-configuration), two security providers should be defined in the app to be later referenced by the OAuth2 Configuration element. One way of doing this is using the Spring Framework, defining both security providers, and then using the [Spring Module](https://docs.mulesoft.com/spring-module/latest/) to add the providers to the Mule Security Manager: ```xml ``` ## General Configuration ```xml ``` ## See Also [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.0 --- # OAuth2 Provider Module Example > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module supports a Mule runtime engine (Mule) application to be configured as an Authentication Manager in an OAuth2 authorization framework. By using this module, the application can register clients, authenticate registered clients, grant tokens, validate tokens, and delete clients. The following example shows how to configure the **Create client** and **Validate token** operations, that create and validate client credentials. ![OAuth provider studio flow](/mulesoft/current/en-us/oauth2-provider-module/1.0/_images/oauth2-provider-example.png) 1. In Studio, drag the HTTP **Listener** operation to the Studio canvas. 2. Set **Path** to `/createClient`. 3. Set the **Connector configuration** to your desired HTTP configuration. 4. Drag the **Create client** operation alongside the HTTP **Listener** operation. 5. Set **Module configuration** to your desired OAuth2 provider module configuration. 6. Set the following parameters: - **Client id**: `attributes.headers.client_id` - **Type**: `CONFIDENTIAL` - **Secret**: `attributes.headers.client_secret` - **Client name**: `attributes.headers.client_name` - **Description**: `””` - **Principal**: `””` - **Redirect uris**: `”demo.com”` - **Authorized grant types**: `”CLIENT_CREDENTIALS”` 7. Drag a **Set Payload** component alongside the **Create client** operation. 8. Set **Value** to `Client Created`. 9. Drag a new HTTP **Listener** source to a new flow. 10. Set **Path** to `/validate`. 11. Drag a **Validate token** operation alongside the **Listener** source. 12. Set **Module configuration** to your desired OAuth2 provider module configuration. 13. Set **Access token** to `(attributes.headers['authorization'] splitBy ' ')[1]`. 14. Drag a **Transform Message** component alongside the **Validate token** operation. 15. In the output display, add the following DataWeave code: ```dataweave %dw 2.0 output application/json --- { "Message": "Successfully validated" } ``` 16. Save and run your Mule app. ## Test your Mule App To test the Mule app, run the following commands: `[http://oauthtest01.us-e2.cloudhub.io/createClient](http://oauthtest01.us-e2.cloudhub.io/createClient)` Method: GET Param: client\_id, client\_secret, client\_name For example, setting the GET parameters fields with the following values `client_id = 123`, `client_secret = 1234`, `client_name = abc` Returns the following result: ```xml { "Message": "Client Created" } ``` `[http://oauthtest01.us-e2.cloudhub.io/token](http://oauthtest01.us-e2.cloudhub.io/token)` Method: POST Param: client\_id, client\_secret, grant\_type For example, setting the POST parameters fields with the following values: `client_id = 123`, `client_secret = 1234`, `grant_type = CLIENT_CREDENTIALS` Returns the following result: ```xml {"access_token":"s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ", "token_type":"Bearer", "expires_in":86400} ``` Another option is to run the validate command: `[http://oauthtest01.us-e2.cloudhub.io/validate](http://oauthtest01.us-e2.cloudhub.io/validate)` Method: GET Param: Authorization 1. Put the `token_type` received from the response data which is "Bearer". 2. Add a space. 3. Add the `access_token` received from the response data. For example, the Authorization equals to the Bearer: ```xml Bearer s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ ``` Returns the following result: ```xml { "Message": "Successfully validated" } ``` If the response is not valid, the result is the following: ```xml The token received: s143BarjxpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ, is not valid. ``` ## See Also - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.1 --- # OAuth2 Provider Module Example > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module supports a Mule runtime engine (Mule) application to be configured as an Authentication Manager in an OAuth2 authorization framework. By using this module, the application can register clients, authenticate registered clients, grant tokens, validate tokens, and delete clients. The following example shows how to configure the **Create client** and **Validate token** operations, that create and validate client credentials. ![OAuth provider studio flow](/mulesoft/current/en-us/oauth2-provider-module/1.1/_images/oauth2-provider-example.png) 1. In Studio, drag the HTTP **Listener** operation to the Studio canvas. 2. Set **Path** to `/createClient`. 3. Set the **Connector configuration** to your desired HTTP configuration. 4. Drag the **Create client** operation alongside the HTTP **Listener** operation. 5. Set **Module configuration** to your desired OAuth2 provider module configuration. 6. Set the following parameters: - **Client id**: `attributes.headers.client_id` - **Type**: `CONFIDENTIAL` - **Secret**: `attributes.headers.client_secret` - **Client name**: `attributes.headers.client_name` - **Description**: `””` - **Principal**: `””` - **Redirect uris**: `”demo.com”` - **Authorized grant types**: `”CLIENT_CREDENTIALS”` 7. Drag a **Set Payload** component alongside the **Create client** operation. 8. Set **Value** to `Client Created`. 9. Drag a new HTTP **Listener** source to a new flow. 10. Set **Path** to `/validate`. 11. Drag a **Validate token** operation alongside the **Listener** source. 12. Set **Module configuration** to your desired OAuth2 provider module configuration. 13. Set **Access token** to `(attributes.headers['authorization'] splitBy ' ')[1]`. 14. Drag a **Transform Message** component alongside the **Validate token** operation. 15. In the output display, add the following DataWeave code: ```dataweave %dw 2.0 output application/json --- { "Message": "Successfully validated" } ``` 16. Save and run your Mule app. ## Test your Mule App To test the Mule app, run the following commands: `[http://oauthtest01.us-e2.cloudhub.io/createClient](http://oauthtest01.us-e2.cloudhub.io/createClient)` Method: GET Param: client\_id, client\_secret, client\_name For example, setting the GET parameters fields with the following values `client_id = 123`, `client_secret = 1234`, `client_name = abc` Returns the following result: ```xml { "Message": "Client Created" } ``` `[http://oauthtest01.us-e2.cloudhub.io/token](http://oauthtest01.us-e2.cloudhub.io/token)` Method: POST Param: client\_id, client\_secret, grant\_type For example, setting the POST parameters fields with the following values: `client_id = 123`, `client_secret = 1234`, `grant_type = CLIENT_CREDENTIALS` Returns the following result: ```xml {"access_token":"s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ", "token_type":"Bearer", "expires_in":86400} ``` Another option is to run the validate command: `[http://oauthtest01.us-e2.cloudhub.io/validate](http://oauthtest01.us-e2.cloudhub.io/validate)` Method: GET Param: Authorization 1. Put the `token_type` received from the response data which is "Bearer". 2. Add a space. 3. Add the `access_token` received from the response data. For example, the Authorization equals to the Bearer: ```xml Bearer s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ ``` Returns the following result: ```xml { "Message": "Successfully validated" } ``` If the response is not valid, the result is the following: ```xml The token received: s143BarjxpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ, is not valid. ``` ## See Also - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.2 is-latest-version: true --- # OAuth2 Provider Module Example > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The OAuth2 Provider module supports a Mule runtime engine (Mule) application to be configured as an Authentication Manager in an OAuth2 authorization framework. By using this module, the application can register clients, authenticate registered clients, grant tokens, validate tokens, and delete clients. The following example shows how to configure the **Create client** and **Validate token** operations, that create and validate client credentials. ![OAuth provider studio flow](/mulesoft/current/en-us/oauth2-provider-module/latest/_images/oauth2-provider-example.png) 1. In Studio, drag the HTTP **Listener** operation to the Studio canvas. 2. Set **Path** to `/createClient`. 3. Set the **Connector configuration** to your desired HTTP configuration. 4. Drag the **Create client** operation alongside the HTTP **Listener** operation. 5. Set **Module configuration** to your desired OAuth2 provider module configuration. 6. Set the following parameters: - **Client id**: `attributes.headers.client_id` - **Type**: `CONFIDENTIAL` - **Secret**: `attributes.headers.client_secret` - **Client name**: `attributes.headers.client_name` - **Description**: `””` - **Principal**: `””` - **Redirect uris**: `”demo.com”` - **Authorized grant types**: `”CLIENT_CREDENTIALS”` 7. Drag a **Set Payload** component alongside the **Create client** operation. 8. Set **Value** to `Client Created`. 9. Drag a new HTTP **Listener** source to a new flow. 10. Set **Path** to `/validate`. 11. Drag a **Validate token** operation alongside the **Listener** source. 12. Set **Module configuration** to your desired OAuth2 provider module configuration. 13. Set **Access token** to `(attributes.headers['authorization'] splitBy ' ')[1]`. 14. Drag a **Transform Message** component alongside the **Validate token** operation. 15. In the output display, add the following DataWeave code: ```dataweave %dw 2.0 output application/json --- { "Message": "Successfully validated" } ``` 16. Save and run your Mule app. ## Test your Mule App To test the Mule app, run the following commands: `[http://oauthtest01.us-e2.cloudhub.io/createClient](http://oauthtest01.us-e2.cloudhub.io/createClient)` Method: GET Param: client\_id, client\_secret, client\_name For example, setting the GET parameters fields with the following values `client_id = 123`, `client_secret = 1234`, `client_name = abc` Returns the following result: ```xml { "Message": "Client Created" } ``` `[http://oauthtest01.us-e2.cloudhub.io/token](http://oauthtest01.us-e2.cloudhub.io/token)` Method: POST Param: client\_id, client\_secret, grant\_type For example, setting the POST parameters fields with the following values: `client_id = 123`, `client_secret = 1234`, `grant_type = CLIENT_CREDENTIALS` Returns the following result: ```xml {"access_token":"s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ", "token_type":"Bearer", "expires_in":86400} ``` Another option is to run the validate command: `[http://oauthtest01.us-e2.cloudhub.io/validate](http://oauthtest01.us-e2.cloudhub.io/validate)` Method: GET Param: Authorization 1. Put the `token_type` received from the response data which is "Bearer". 2. Add a space. 3. Add the `access_token` received from the response data. For example, the Authorization equals to the Bearer: ```xml Bearer s143Barj7xpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ ``` Returns the following result: ```xml { "Message": "Successfully validated" } ``` If the response is not valid, the result is the following: ```xml The token received: s143BarjxpQP3_AGWvHRyZxFNEcgJ55XB1I3Yquj8kgem2qxqa5TpouLG3gQCr2sj170Ci1MqLd5gzF4AUpRQ, is not valid. ``` ## See Also - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.0 --- # OAuth2 Provider Module Reference > For the full documentation index, see: https://docs.mulesoft.com/llms.txt OAuth2 Provider Module v1.0 The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. ## Configurations --- ### Default Configuration OAuth2 Provider module configuration #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

The name for this configuration. Connectors reference the configuration with this name.

x

Provider Name

String

The provider name supplied to customers of the API. This is used for some responses of the OAuth2 API.

Listener Config

String

The name of an HTTP Listener Config to reference, which handles the token and authorization endpoints.

x

Client Validation Rate Limiter

The rate limiter used to control access to certain operations. If none is specified, PeriodRateLimiter is used as the default.

Client Store

Object Store

A store that allows retrieving client configuration information, like their secret. If no client store is provided, a default in memory object store is configured.

Resource Owner Security Provider

String

The security provider used to authenticate resource owners. Not needed if only the CLIENT_CREDENTIALS grant type is used. Refer to an example with Spring module in migrating the OAuth2 provider documentation.

Client Security Provider

String

The security provider used to authenticate clients. Not needed if only public clients or private clients with secrets are used

Token Generator Strategy

TokenGeneratorStrategy

The strategy used to generate access tokens. Should reference a class that implements TokenGeneratorStrategy.

Supported Grant Types

Enumeration, list of:

  • AUTHORIZATION_CODE

  • IMPLICIT

  • RESOURCE_OWNER_PASSWORD_CREDENTIALS

  • CLIENT_CREDENTIALS

The comma-separated grant types this provider supports. If none specified, only the authorization code grant type is supported.

AUTHORIZATION_CODE

Scopes

String

A comma-separated list of supported scopes.

Default Scopes

String

A comma-separated list of the default scopes a client should have if none is defined.

Token Config

Information for configuring token related behavior.

Authorization Config

Information for configuring authorization handling behavior

Clients

Array of Client

A list of clients.

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the platform expires the instance at the exact moment that it becomes eligible. Mule purges the instances as appropriate.

## Operations - [Create Client](#createClient) - [Delete Client](#deleteClient) - [Revoke Token](#revokeToken) - [Validate Token](#validateToken) ### Create Client `` Creates a new client and saves it in the configured client store. ```xml ``` #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID to assign to the created client.

x

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The type of the client. Allowed values are PUBLIC: Clients incapable of maintaining the confidentiality of their credentials, or CONFIDENTIAL: Clients capable of maintaining the confidentiality of their credentials.

PUBLIC

Secret

String

Client Name

String

A friendly name for the client.

Description

String

A brief description of the client.

Principal

String

An optional principal to use when the ID can’t be used with the security provider.

Redirect Uris

Array of String

An expression that resolves to a list of redirect URIs used for when the client makes requests to the OAuth Provider.

Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

An expression that resolves to a list of the authorized grant types that the client can use to request a token.

Scopes

Array of String

An expression that resolves to a list of supported scopes by the client. If none are provided, the default scopes of the General Configuration are used.

Fail If Present

Boolean

Defines what to do if a client with the same ID is already registered. If true, an error is raised. Otherwise, the client is updated.

false

### For Configurations [Default Configuration](#config) #### Throws - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS - If a client already exists with the same client ID, and **Fail If Present** is set to `true`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION - If the provided parameters are not valid, such as having **Authorized Grant Types** of AUTHORIZATION\_CODE but without a redirect URI. ### Delete Client `` Deletes a client from the store. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Client Id

String

The ID of the client to be deleted.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:NO\_SUCH\_CLIENT - The client to be deleted does not exist. ### Revoke Token `` Revokes an access token or refresh token, invalidating the related refresh token or access token as well. If client credentials need to be validated, use the validateClient credential before revoking the token. #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of a globally defined OAuth Provider configuration to use for token validation.

x

Token

String

The token to revoke, it can be an access token or a refresh token.

x

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:INVALID\_TOKEN - The token to be revoked is not valid. ### Validate Token `` Checks that a valid access token is provided. Validates that the given token was granted and is in a valid state. Also, if defined, checks that the token scopes or resource owner roles match the provided ones. If the provided token is valid, the operation sets the payload as a JSON with the following information: - expires\_in: Time remaining for the token to be considered invalid, in seconds. - scope: Space separated scopes associated with the token. - client\_id: ID of the client that requested this token. - username: Username of the resource owner that authorized this token to be requested. To preserve the payload set before executing the operation, you can use the `target` and `targetValue` attributes to set the JSON information in a variable instead of overwriting the payload. Validate Token parameters: #### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

The name of the configuration to use.

x

Access Token

String

#[(attributes.headers['authorization'] splitBy ' ')[1]]

Scopes

Array of String

An expression that resolves to a list of scopes to enforce when validating the token.

Resource Owner Roles

Array of String

The resource owner roles to enforce when validating the token. This is an expression that resolves to a list of resource owner roles to enforce when validating the token.

Target Variable

String

The name of a variable to store the operation’s output.

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

#### Output

Type

String

### For Configurations [Default Configuration](#config) #### Throws OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED - The token being validated is not valid. ## Types ### Token Configuration Configuration related to token handling and the token endpoint.
FieldTypeDescriptionDefault ValueRequired

Path

String

Endpoint to call when wanting to request a new token

/token

Token Store

Object Store

ObjectStore configuration information for storing token related data

Refresh Token Strategy

The refresh token strategy to use. By default no refresh token should be generated

Token Ttl

Number

The time in seconds before an access token code expires.

86400

Token Ttl Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

The time unit for the token ttl.

SECONDS

### Authorization Config Configuration related to authorization code handling and the authorization endpoint.
FieldTypeDescriptionDefault ValueRequired

Login Page

String

Relative file path to the web page for the resource owner to provide its credentials.
Keep in mind that if the default page is not used, you need to handle any external files referenced in the configured HTML. They are not handled by the OAuth provider.
For example, if the login page HTML references an external .css style file, an endpoint that provides that file must exist. See HTTP Load Static Resource.

www-static/auth.html

Path

String

The URL relative path to the authorization endpoint in the HTTP server for listening to authorization requests.

/authorize

Authorization Code Store

Object Store

A reference to a globally defined object store or a definition of a private object store. It’s used to store generated authorization codes.

A persistent object store created from the ObjectStoreManager with an entry TTL of 600 SECONDS.

### Client All registered clients are authorized to request tokens. The list can be modified in runtime by the [Create Client](#createClient) and [Delete Client](#deleteClient) operations. ```xml ``` Each registered client has an entry with the following information:
FieldTypeDescriptionDefault ValueRequired

Client Id

String

A unique ID that will used to reference the client

x

Principal

String

An optional principal to use when the ID can’t be used with the security provider. For some security providers, the clientId can’t be used for the client username. In those cases, the client’s principal is used for authentication.

Client Name

String

The name of the client

Description

String

A short description for the client

Secret

String

A client secret used to authenticate the client. Only required if Type is CONFIDENTIAL.

Client Redirect Uris

Array of String

List of registered redirect URIs to use to respond to the client once the request is processed.

Most requests allow the definition of new redirection URIs so these are not always taken into account. See also New Value Handling.

<oauth2-provider:client-scope value="USER"/>

Client Authorized Grant Types

Array of Enumeration, one of:

  • AUTHORIZATION_CODE

  • REFRESH_TOKEN

  • TOKEN

  • PASSWORD

  • CLIENT_CREDENTIALS

The grant types that define which OAuth flows this client will be able to be successfully execute to get a token. See also New Value Handling.

Client Scopes

Array of String

The scopes that will match this client. If a request is received with a matching client ID but with different scopes, it will not be processed. See also New Value Handling.

Type

Enumeration, one of:

  • CONFIDENTIAL

  • PUBLIC

The client type defines if the client is able to maintain confidentiality for its credentials. Allowed values are PUBLIC, where clients do not maintain the confidentiality of their credentials, or CONFIDENTIAL, where clients maintain the confidentiality of their credentials.

PUBLIC

For client redirect URIs, client authorized grant types, or client scopes, give each new value a new XML tag: `` `` ### Expiration Policy
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

A scalar time value for the maximum amount of time a dynamic configuration instance should be allowed to be idle before it’s considered eligible for expiration

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

A time unit that qualifies the maxIdleTime attribute

### No Refresh Token No refresh token is granted with every access token. As a consequence, when a refresh token request comes, it is always rejected.
FieldTypeDescriptionDefault ValueRequired

Token Generator Strategy

TokenGeneratorStrategy

### Single Refresh Token For every new access token that is granted, a single refresh token is associated with it. That same refresh token can be used every time the access token is refreshed.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store or a definition of a private object store for storing generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Multiple Refresh Tokens A new refresh token is generated every time a refresh token request is executed. After that, the previous refresh token is invalidated.
FieldTypeDescriptionDefault ValueRequired

Object Store

Object Store

A reference to a globally defined object store, or a definition of a private object store that stores the generated refresh tokens. The object store must be different from the access token object store.

A persistent object store created from the ObjectStoreManager with an entry TTL of 86400 seconds.

### Period Rate Limiter Period Rate Limiter handles rate limiting based on a time period. You can configure a mechanism to prevent the continuous client validation when it’s using invalid credentials.
FieldTypeDescriptionDefault ValueRequired

Duration

Number

The time to wait before resetting the rate limiter. That means that during time intervals of duration length, every time a client validation fails, it will be added to the failure count.

600

Duration Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

SECONDS

Maximum Failure Count

Number

Maximum number of failures allowed within the period before preemptively rejecting requests.

5

## OAuth Dance Because the OAuth dance is done through HTTP, the OAuth2 Provider makes use of the [Mule HTTP Connector](https://docs.mulesoft.com/http-connector/latest/). As a consequence, apart from the definition of an OAuth2 provider configuration, the Mule application must also have an HTTP Listener configuration to be used by the provider. Once configured, the provider works as follows: Two HTTP endpoints are created for listening to Authentication Code and Token request as stated by the OAuth2 definition. Those work independently from the Mule application and respond via HTTP. The provider defines an operation: [Validate Token](#validateToken) that can check if a token is authorized. That operation can be added anywhere in a flow to control its execution. If the token is indeed authorized, the flow continues executing, setting token information in the payload; otherwise, a `TOKEN_UNAUTHORIZED` error is raised. You need to add the operation to the parts of the application that require token authorization. Since token validation is almost always used together with an HTTP Listener, in case it fails, the Listener’s response mechanism can handle the error and properly respond to the requester. Additional logic can be added for handling that type of error. Lastly, additional operations are provided to add or delete clients and to revoke tokens if needed. ## Security Providers As seen in the [General Configuration](#general-configuration), two security providers should be defined in the app to be later referenced by the OAuth2 Configuration element. One way of doing this is using the Spring Framework, defining both security providers, and then using the [Spring Module](https://docs.mulesoft.com/spring-module/latest/) to add the providers to the Mule Security Manager: ```xml ``` ## General Configuration ```xml ``` ## See Also [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.0 --- # OAuth2 Provider Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-oauth2-provider-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for ``. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.1 --- # OAuth2 Provider Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-oauth2-provider-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for ``. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.2 is-latest-version: true --- # OAuth2 Provider Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-oauth2-provider-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for ``. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.0 --- # Troubleshooting OAuth2 Provider Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot OAuth2 Provider module, become familiar with the information about enabling verbose logging and interpreting commonly throw messages. ## Enable Verbose Logging To get a better understanding of why an application’s interaction with OAuth2 Provider module is failing, temporarily enable verbose logging for the module. Remember to always disable the enhanced verbosity after troubleshooting, because it affects your Mule application performance. To enable verbose logging in the configuration file: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application’s project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add an `` tag inside the `` tag: ```xml ... ... ``` 6. Save your application changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. ## Understand Common Throws Here is a list of common thrown messages and how to interpret them: - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS A client already exists with the same client ID, and the \*Fail If Present\* field is set to \`true\`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION The provided parameters are invalid, for example, the \*Authorized Grant Types\* field of \`AUTHORIZATION\_CODE\` does not have a redirect URI. - OAUTH2-PROVIDER:NO\_SUCH\_CLIENT The client to delete does not exist. - OAUTH2-PROVIDER:INVALID\_TOKEN The token to revoke is invalid. - OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED The token is invalid or there are missing or wrong fields set in the validation. - OAUTH2-PROVIDER:OAUTH\_SERVER\_SECURITY OAuth2 Provider module throws this error when is unable to identify its reason. ## See Also - [Salesforce Help](https://help.salesforce.com) --- product: OAuth2 Provider Module version: 1.1 --- # Troubleshooting OAuth2 Provider Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot OAuth2 Provider module, become familiar with the information about enabling verbose logging and interpreting commonly throw messages. ## Enable Verbose Logging To get a better understanding of why an application’s interaction with OAuth2 Provider module is failing, temporarily enable verbose logging for the module. Remember to always disable the enhanced verbosity after troubleshooting, because it affects your Mule application performance. To enable verbose logging in the configuration file: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application’s project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add an `` tag inside the `` tag: ```xml ... ... ``` 6. Save your application changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. ## Understand Common Throws Here is a list of common thrown messages and how to interpret them: - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS A client already exists with the same client ID, and the \*Fail If Present\* field is set to \`true\`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION The provided parameters are invalid, for example, the \*Authorized Grant Types\* field of \`AUTHORIZATION\_CODE\` does not have a redirect URI. - OAUTH2-PROVIDER:NO\_SUCH\_CLIENT The client to delete does not exist. - OAUTH2-PROVIDER:INVALID\_TOKEN The token to revoke is invalid. - OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED The token is invalid or there are missing or wrong fields set in the validation. - OAUTH2-PROVIDER:OAUTH\_SERVER\_SECURITY OAuth2 Provider module throws this error when is unable to identify its reason. ## See Also - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues) --- product: OAuth2 Provider Module version: 1.2 is-latest-version: true --- # Troubleshooting OAuth2 Provider Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot OAuth2 Provider module, become familiar with the information about enabling verbose logging and interpreting commonly throw messages. ## Enable Verbose Logging To get a better understanding of why an application’s interaction with OAuth2 Provider module is failing, temporarily enable verbose logging for the module. Remember to always disable the enhanced verbosity after troubleshooting, because it affects your Mule application performance. To enable verbose logging in the configuration file: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application’s project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add an `` tag inside the `` tag: ```xml ... ... ``` 6. Save your application changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. ## Understand Common Throws Here is a list of common thrown messages and how to interpret them: - OAUTH2-PROVIDER:CLIENT\_ALREADY\_EXISTS A client already exists with the same client ID, and the \*Fail If Present\* field is set to \`true\`. - OAUTH2-PROVIDER:INVALID\_CONFIGURATION The provided parameters are invalid, for example, the \*Authorized Grant Types\* field of \`AUTHORIZATION\_CODE\` does not have a redirect URI. - OAUTH2-PROVIDER:NO\_SUCH\_CLIENT The client to delete does not exist. - OAUTH2-PROVIDER:INVALID\_TOKEN The token to revoke is invalid. - OAUTH2-PROVIDER:TOKEN\_UNAUTHORIZED The token is invalid or there are missing or wrong fields set in the validation. - OAUTH2-PROVIDER:OAUTH\_SERVER\_SECURITY OAuth2 Provider module throws this error when is unable to identify its reason. ## See Also - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues)