Question
Accenture
GB
Last activity: 16 Jun 2022 6:28 EDT
advice on implementing OAuth 2.0 using the client credentials flow in pega 7.3.1
I have a requirement to access an external web service from pega 7.3.1 using OAuth 2.0 with the client credentials flow. Anyone have any experience of this would like to share best practice?
I can see that later versions of pega allow more configuration when creating an authentication profile ie the connection to the token provider
***Edited by Moderator Marije to add Support Case Details; FDBK***
Updated: 24 Feb 2022 7:25 EST
Accenture
GB
@matthewk2081 ok so I have made some progress on this - the last challenge - hopefully is configuring the O Auth 2.0 Authentication profile. I was hoping to be able to populate the secret value using Global Resources Settings but it appears that field doesnt support that syntax https://docs.pega.com/data-management-and-integration/85/fields-support-global-resource-settings-syntax#Fields_that_support_the_Global_Resource_Settings_syntax.
What is an alternative way if hard coding the value is not an option?
Delta Dental Insurance Company
US
@matthewk2081 I am researching how to dynamically pass in the client secret, as we don't want devs to maintain/access the key. Have you found a way to use GRS or other dynamic approach?
Pegasystems Inc.
GB
Hello @matthewk2081. I checked to try to find the SR you reference. Is it the one you logged on 28 February?
SR-113418/ INC-213581 (security issue in O Auth 2.0 authentication profile)
I have checked the investigation that was carried out:
On March 7th the support engineer informed you that this is an enhancement request
FDBK-86037 was created on your behalf, and this information was passed back to you, which you acknowledged.
Details of the enhancement request for our engineering team to consider for a future version:
"Request is for the client secret field for an OAuth 2.0 Authentication profile to support Global Resources settings (ref: https://docs.pega.com/data-management-and-integration/85/configuring-dynamic-references-external-systems-using-global-resource-settings-feature) or a suitable workaround. Currently the client secret would have to be hard coded which from a security standpoint is unacceptable is preventing us from using this functionality."
Therefore I believe we have answered your question. Feel free to follow up the FDBK with your Pega AE if required.
I have linked it to this forum question for visibility.