OAuth2 Authorization Grant Flow#

The OAuth2 Authorization Grant Flow strategy signs in users through an identity provider that supports the OAuth 2.0 Authorization Code grant but not OpenID Connect. For providers that support OpenID Connect, use the OpenID Connect ↗ strategy.

Configuration#

Not available out of the box, and standard deployments don't load the @criticalmanufacturing/auth-plugin-oauth2 plugin. Add the plugin to the plugins list and the strategy to the tenant through a customization package. See Deployment via CmfEntrypoint ↗ in the Developer Portal.

In this section, <Security Portal URL> is the public address of the Security Portal, for example https://mes.example.com/SecurityPortal.

Parameters#

Strategy type	Plugin
`oauth2-AuthorizationGrantFlow`	`@criticalmanufacturing/auth-plugin-oauth2`

Table: OAuth2 Authorization Grant Flow strategy type and plugin

Each strategy entry also accepts the common strategy properties.

Parameter	Required	Description
`authorizationUrl`	Yes	Authorization endpoint of the provider, where the user is redirected to sign in.
`tokenUrl`	Yes	Token endpoint of the provider, where the authorization code is exchanged for an access token.
`userInfoUrl`	Yes	Endpoint of the provider that returns the profile of the signed-in user.
`clientId`	Yes	Client ID of the application registered in the provider.
`clientSecret`	No	Client secret of the application. If omitted, the Security Portal uses PKCE.
`scopes`	Yes	Scopes to request, for example `email`.
`redirectUrl`	Yes	`<Security Portal URL>/tenant/<TenantName>/login/callback`. Register the same URL in the provider.
`profileUserAccountPath`	No	Path of the user profile property, returned by `userInfoUrl`, that is matched against the MES user account and then the email address. Default: `sub`.

Table: OAuth2 Authorization Grant Flow strategy parameters

Example#

{
  "id": "OAuth2",
  "type": "oauth2-AuthorizationGrantFlow",
  "config": {
    "authorizationUrl": "https://<ProviderAddress>/oauth2/authorize",
    "tokenUrl": "https://<ProviderAddress>/oauth2/token",
    "userInfoUrl": "https://<ProviderAddress>/oauth2/profile",
    "redirectUrl": "<Security Portal URL>/tenant/<TenantName>/login/callback",
    "clientId": "<ClientID>",
    "clientSecret": "<ClientSecret>",
    "scopes": "email",
    "profileUserAccountPath": "id"
  }
}