Product Requirement: Native OAuth with External Identity Provider for Three-Legged OAuth

Business Need

Business Need

Enable API Connect Native OAuth to:

• Support three-legged OAuth flows where API Connect issues codes and tokens.

• Delegate user authentication to external IdPs via redirect.

• Preserve centralized token lifecycle management in API Connect.

This capability ensures:

• Developer Portal remains the hub for client registration and API subscription.

• API Connect enforces scopes, rate limits, and token policies.

• External IdPs provide enterprise-grade user authentication.

Current Limitation

Native OAuth:

• Supports internal user registries or Authentication URL but lacks redirect-based external IdP integration.

• Requires custom assemblies or orchestration to achieve nested OAuth.

• under user authentication, none of the external oidc user registries are supported.

Functional Requirements

Client Registration

• Register client apps in Developer Portal with client_id, client_secret, and redirect_uri.

• Subscribe clients to APIs.

Authorization Flow

• /authorize:

  • Validate client credentials and redirect URI.

  • Redirect end-user to external IdP authorization endpoint.

  • Handle callback from IdP with code and state.

  • Generate API Connect authorization code and persist mapping to IdP session.

Token Exchange

• /token:

  • Validate API Connect authorization code.

  • Optionally exchange IdP code for user claims.

  • Issue API Connect access/refresh tokens enriched with IdP claims.

Configuration

• UI/CLI options to:

  • Configure external IdP endpoints (authorize, token, userinfo).

  • Define scopes and claims mapping.

  • Enable/disable external authentication per OAuth provider.

Security

• Support PKCE, state, and nonce validation.

• TLS for all redirects and token exchanges.