---
alias: operation-guide-security-portal-strategy-oauth2
description: "Sign in users through an OAuth 2.0 identity provider that does not support OpenID Connect."
---

# OAuth2 Authorization Grant Flow

The **OAuth2 Authorization Grant Flow** strategy signs in users through an identity provider that supports the [OAuth 2.0 Authorization Code grant](https://oauth.net/2/grant-types/authorization-code/) but not OpenID Connect. For providers that support OpenID Connect, use the [[operation-guide-security-portal-strategy-openidconnect|OpenID Connect]] strategy.

## Configuration

Not available out of the box, and standard deployments don't load the `@criticalmanufacturing/auth-plugin-oauth2` plugin. Add the plugin to the `plugins` list and the strategy to the tenant through a customization package. See [Deployment via CmfEntrypoint](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/configuration/#deployment-via-cmfentrypoint) in the Developer Portal.

In this section, `<Security Portal URL>` is the public address of the Security Portal, for example `https://mes.example.com/SecurityPortal`.

### Parameters

| **Strategy type**               | **Plugin**                                  |
|---------------------------------|---------------------------------------------|
| `oauth2-AuthorizationGrantFlow` | `@criticalmanufacturing/auth-plugin-oauth2` |

Table: OAuth2 Authorization Grant Flow strategy type and plugin

Each strategy entry also accepts the [common strategy properties](../security-portal-configuration/security_portal_config_securityportal.md#common-strategy-properties).

| **Parameter**            | **Required** | **Description**                                                                                                                                        |
|--------------------------|--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| `authorizationUrl`       | Yes          | Authorization endpoint of the provider, where the user is redirected to sign in.                                                                       |
| `tokenUrl`               | Yes          | Token endpoint of the provider, where the authorization code is exchanged for an access token.                                                         |
| `userInfoUrl`            | Yes          | Endpoint of the provider that returns the profile of the signed-in user.                                                                               |
| `clientId`               | Yes          | Client ID of the application registered in the provider.                                                                                               |
| `clientSecret`           | No           | Client secret of the application. If omitted, the Security Portal uses PKCE.                                                                           |
| `scopes`                 | Yes          | Scopes to request, for example `email`.                                                                                                                |
| `redirectUrl`            | Yes          | `<Security Portal URL>/tenant/<TenantName>/login/callback`. Register the same URL in the provider.                                                     |
| `profileUserAccountPath` | No           | Path of the user profile property, returned by `userInfoUrl`, that is matched against the MES user account and then the email address. Default: `sub`. |

Table: OAuth2 Authorization Grant Flow strategy parameters

### Example

```json
{
  "id": "OAuth2",
  "type": "oauth2-AuthorizationGrantFlow",
  "config": {
    "authorizationUrl": "https://<ProviderAddress>/oauth2/authorize",
    "tokenUrl": "https://<ProviderAddress>/oauth2/token",
    "userInfoUrl": "https://<ProviderAddress>/oauth2/profile",
    "redirectUrl": "<Security Portal URL>/tenant/<TenantName>/login/callback",
    "clientId": "<ClientID>",
    "clientSecret": "<ClientSecret>",
    "scopes": "email",
    "profileUserAccountPath": "id"
  }
}
```