Oracle Integration Cloud Gen3 aka OIC3: OAuth2.0 for OIC REST APIs

In this blog I will try to touch up on why & how to use OAuth2.0 with OIC3.

Why OAuth2.0 with OIC3

With the latest security amendments OCI has mandated MFA for every user login. So, to make a call to any of the OCI services you need to go with either OAuth or OCI API Key.

OIC REST APIs don’t allow using OCI API Keys aka OCI Signature. Hence, you need to use only OAuth as the Authentication mechanism.

Till OIC Gen2 we used to create a Client & Server applications for OAuth2.0. With OIC3, you just have to create a Client application and use the Oracle provided Server application of your OIC instance and then assign the client application to the user in Server application along with the appropriate user role.

Creating OIC3 Client application

1. Create a Confidential application

In the next step/screen, I will be only providing with application name only.

In the next screen/step I have selected it to create as a client application, followed by few grant types for Authorization and provided the Redirect URL, which is your OIC3 Instance/Service Console URL suffixed with “/icsapis/agent/oauth/callback” as shown below.

In addition, I have chosen the below:

1. “Allowed operations” as “On behalf of”
2. “Allowed Resources” as “All”
3. Check “All Resources” checkbox, click on “Add Scope”, search for your OIC3 Instance, select that and all the scopes under that.

Click Skip & Finish the client application creation.

Once done, activate your application which then generates Client Id & Client Secret which is to be used in your OAuth2.0 authorization to generate Access Token.

Mapping Client Application with OIC Server Application

Now let us map the created Client Application with the OIC3 Server application for which follow the below steps:

Go to Oracle Cloud Services and select your OIC Instance

Assign the Client application created in the earlier step for an Application role as shown below

Then click on “Show available applications”, search for your Client Application, select that, click “Assign” and close.

This completes creating Client Application and connecting it with OIC Server application.

Security Parameters in the REST Connection to OIC

In the connection perform the below:

1. Select Security Policy as “OAuth Client Credentials”.
2. Provide your IDCS URL suffixed with “/oauth2/v1/token” for “Access Token URL”.
3. Copy & Paste the Client Id & Client Secret generated on the Client Application created earlier.
4. Under “Optional security”, under “Scope” provide the scopes which you have selected in your Client application. Here I have provided both the OIC Instance scopes.
5. Select “Client Authentication” as “Send client credentials as basich auth header”.

Updating Security on the Trigger Connection in OIC to accept OAuth

Now to invoke OIC with OAuth2.0, though we have created client application, we need to also enable the connection (adapter’s connection) to accept OAuth2.0 as shown below

Testing OIC REST API Integration Eg: RetrieveLookUp API

Set “AuthType” in Postman to “OAuth2.0” and populate data to generate Access Token as shown below, all the data will be available in your OIC Client Application created in the previous steps.

This completes OAuth2.0 with OIC3.

!!Happy Reading!!