OIDC Connect - Authentication - Access Token
Hi,
I have implemented OIDC Connect authentication in my application and IDP is PingOne. The authentication flow is working as expected. IDP returns both AccessToken and IDToken in the api as part of authentication. However Pega is only saving IDToken to Clipboard pages and AccessToken is not saved to any page on clipboard. How do i retrieve/get the AccessToken in the post authentication activity. After authentication, We have a requirement to call external API by passing AccessToken as parameter to login/authenticate user in external system and retrieve the token from external system and use the token in the subsequent API calls to the external system.
S&P Global (Ratings)
US
Coforge
IN
@PRAVINJEROME Were you able to get the refresh token also.
We have to capture both the access token and refresh tokens and maintain in clipboard for future interactions in case life cycle.
Any help is appreciated.
Regards,
Burhan.
Inovar
SA
Any further post on this . As we have similar requirement. token which PEGA stores may not be direct as we need to pass the active SSO token to the external API . Appreciate any quick help.
Pegasystems Inc.
GB
To capture the access token and refresh token in the clipboard after OIDC authentication, you can create a Post Authentication Activity. In this activity, you can access the access token and refresh token from the Data-Admin-Security-AccessTokenKeys instances. You can then store these tokens in the clipboard for future use.
To access the tokens, you can use the Obj-Browse method in your activity to search for instances of Data-Admin-Security-AccessTokenKeys with the appropriate criteria, such as the user identifier or client ID. Once you have retrieved the tokens, you can store them in the clipboard using the Property-Set method.
Please note that you should handle the tokens securely and consider the best practices for managing sensitive data in your application.
Note: This post is over a year old.
I suggest you log a new question if a PSC 'key word' search does not give you any further ideas.
Inovar
SA
I can see the table corresponding to this class (Data-Admin-Security-AccessTokenKeys) does not accept the client identifier when I checked with obj-browse.
Any other alternative to get the refresh token
Pegasystems Inc.
GB
To refresh token, it is also stored in the pr_data_token table, but it is encrypted and not directly accessible. Currently, there is no Pega API to retrieve the RefreshToken for the current user.
If the AccessToken is expired, you have to refresh the AccessToken and pass the latest AccessToken. You can do this by making a Connect-REST call to the Token API to retrieve the AccessToken.
Please note that the scenario you mentioned is supported in Pega 8.6.3.
⚠ This is a GenAI-powered tool. All generated answers require validation against the provided references.
Refresh Token not working in Integrating Google API using OAuth 2.0
@SReddyR87 - Use the below in Post Authentication Activity to get the Access Token in Clipboard
In my case, I have used the
com.pega.pegarules.pub.connect.oauth2.OAuth2Client oauth2Client =
pega.getServiceUtilsPriv().getOAuth2Client(tools,mAuthServicePage,tools.findPage("OperatorID").getString("pyUserIdentifier"));
// get AccessToken from IDP
String accessToken = oauth2Client.getAccessToken();
// Process the Access Token in jwt format to Json
((PegaAPI)tools).getJWTUtils().processJSONWebToken(accessToken,jwtInstancePage);
// Map the JSON Token Data to StepPage
myStepPage.adoptJSONObject(tools.findPage("AccessTokenPage").getString("AccessToken_JSON"));
Note: Pega also stores Access Token in DB in Table PR_DATA_TOKEN - Access Token, Client ID, Scope etc are stored in this table
Hope this helps !
Good Luck!