user oauth-user server
FortiWeb supports front-end authentication with third party authentication servers such as Google and Facebook.
Use this command to add the third party authentication server information.
To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For details, see Permissions.
Syntax
config user oauth-user server
edit <server_name>
set mode {client | resource-server | both}
set token-validation-mode {internal | external}
set scope <string>
set oidc {enable | disable}
set client-id <string>
set client-secret <passwd>
set redirect-endpoint <string>
set authz-req <datasource>
set token-req <datasource>
set validate-req <datasource>
set validate-frequency {session | transaction | interval}
set validate-interval <integer>
set userinfo-req <datasource>
set jwks-req <datasource>
set validate-req <datasource>
set userinfo-req <datasource>
next
end
| mode {client | resource-server | both} |
Select whether FortiWeb works as an authorization client or a resource server, or both. |
No default |
|
token-validation-mode {internal | external}
|
Select how tokens are validated:
|
external
|
| scope <string> |
Enter the scope field for OAuth.
If the OAuth Server is operating in Resource Server mode:
FortiWeb checks the scopes included in the validated access token to ensure they meet the configured requirements.
A request is permitted only when the access token contains every configured scope. Missing scopes result in the request being blocked. When the Scope field is empty, scope checking does not occur.
Examples
|
No default |
|
oidc {enable | disable}
|
Enable to use OIDC authentication.
|
disable
|
|
pkce-enforcement {enable | disable}
|
Enable to enforce PKCE in the authentication flow.
PKCE is a security extension designed to protect the authorization code flow, particularly for public clients like mobile or single-page applications where client secrets cannot be safely stored.
In a standard OAuth flow, a static client secret is used to exchange an authorization code for a token. PKCE replaces or augments this by using a dynamic, per-request code verifier and code challenge.
-
Mitigates Code Interception: Prevents attackers from intercepting the authorization code and using it to obtain access tokens.
-
Prevents Man-in-the-Middle (MITM) Attacks: Ensures that even if an attacker intercepts the code, they cannot exchange it without the original code verifier.
-
Stops App Impersonation: Validates that the client requesting the token is the same one that initiated the authorization request.
This option is only available when the OAuth mode is set to either client or both.
|
disable
|
| client-id <string> |
A client credential. Assigned by authorization server. |
urlencoded |
| client-secret <passwd> |
A client credential. Assigned by authorization server. |
No default |
| redirect-endpoint <string> |
Redirection URL back to FortiWeb. |
disable
|
| authz-req <datasource> |
The authorization request created in config user oauth-user request. |
No default
|
| token-req <datasource> |
The token request created in config user oauth-user request. |
No default
|
| refresh-req <datasource> |
The refresh request created in config user oauth-user request.
|
No default
|
| validate-req <datasource> |
The valid request created in config user oauth-user request.
|
No default
|
| validate-frequency {session | transaction | interval} |
Whether to validate the request per session, transaction, or every several second. |
No default
|
|
validate-interval <integer>
|
If the validate-frequency is interval, then enter the interval time.
|
No default
|
|
userinfo-req <datasource>
|
The user info request created in config user oauth-user request.
|
No default
|
|
jwks-req <datasource>
|
The JWKS request created in config user oauth-user request.
Available only if oidc is enabled and the token-validation-mode is set to external.
|
No default
|
|
validate-req <datasource>
|
It defines the endpoint used to verify opaque tokens with the authorization server.
Available only if the token-validation-mode is set to internal.
|
No default
|
|
userinfo-req <datasource>
|
It specifies the endpoint used to retrieve associated user identity data.
Available only if the token-validation-mode is set to internal.
|
No default
|
Related topics
