Currently I'm developing a new REST connector. For this I have to define a new Authentication and create a new OAuth provider using the REST integration wizard in developer studio (Pega 8).

The API I have to access utilizes a JWT (JSON web token) based authentication. So every API request must include a JWT inside a request header. This happens in conjuction with an implementation of OAuth2 using a HMAC-SHA256 algorithm.

The Authentication and request process I have to follow is like:

1. Construct a JWT using several (custom) fields, including OAuth fields.
2. Call a authorize URI with the JWT.
3. Request will be redirected to Pega redirect_uri with parameter 'code' in the query string.
4. This code has to be used to construct another JWT (with the 'code' and 'grant_type="authorization_code"' fields)
5. POST to access token URI with the JWT.
6. The response will contain an access_token.
7. This token has to be used to construct another JWT (with the 'authorization' field)
8. Finally the Web API can be called with the JWT.

https://api.XXXX.com/YYYYY/ZZZZZ/authorize?redirect_uri=http%3A%2F%2F Proprietary information hidden%3A9080%2Fprweb%2FPRRestService%2Foauth2%2Fv1%2Fredirect&client_id=111222333444XXXXYYY&scope=scope&state=xxxxxxxxxx&response_type=code

{
  "errors": [
    {
      "title": "unauthorized_client",
      "id": "XXX",
      "meta": {
        "server-time": 123
      },
      "errorCode": "unauthorized-client",
      "status": 401,
      "detail": "No definition of jwt found in header or query string."
    }
  ],
  "error_description": "No definition of jwt found in header or query string.",
  "error": "unauthorized_client"
}

1. The encryption does not use the HMAC-SHA256 algorithm. Unfortunately I can't see where I could change this in the setup.
2. There will be not JWT (token) generated in the header of the request (should be done automatically I think).
3. Pega 8 does not support the process flow mentioned above.

• No special definition of a header (assuming that this will be generated automatically by Pega)
• Authentiction scheme: OAuth 2.0
• OAuth provider details:
  • Grant types: Client credentials AND Authorization code
  • All three code and token endpoints (URI's)
  • Send credentials as: POST
  • Send access token as: Authorization header
• Grant type: Authorization code
• All four client information fields
• Additional endpoint parameter: response_type = code

Caught Exception while creating OAuth2 client

Unable to obtain access token for client details in authentication profile configured for connector. Please check the logs for more details.

Access token endpoint invocation failed : {ErrorMessage=Response status : 307 Moved Temporarily, statuscode=307}