An OAuth provider configuration object specifies authorization server endpoints on an external OAuth authorization server.

An OAuth server specifies an OAuth provider and the OAuth role that Access Policy Manager^® (APM^®) plays with that provider. It also specifies the IDs, secrets, and SSL certificates that APM requires to communicate with the OAuth provider.

In Access Policy Manager^® (APM^®), the request object enables configuration of requests to meet the requirements of your OAuth providers. The object supports requests for scope permission, scope data, authorization redirect, and tokens. It specifies the HTTP method, parameters, and headers to use for the specific type of request.

An OAuth Client agent is a policy item that requests authorization and tokens from an OAuth server. An OAuth Client can also validate tokens and get scope data on a per-request basis. The OAuth Client agent provides these configuration elements and options:

Server

Specifies the OAuth server to which this OAuth client directs requests.

Grant Type

Specifies the type of grant that the OAuth client uses.

• Authorization code - The client redirects the resource owner to the OAuth server to request an authorization code.
• Password - The client uses resource owner password credentials to request an access token from the OAuth server.

Authentication Redirect Request

Specifies an auth-redirect-request type request, which redirects a user to an OAuth server. Displays when Grant Type is set to Authorization code.

Token Request

Specifies a token-request type of request.

Refresh Token Request

Specifies a token-refresh-request type of request. APM uses this request on a per-request basis.

Validate Token Request

Specifies a validation-scopes-request type of request to validate a token and to get a list of scopes associated with a token. APM uses this request on a per-request basis.

Redirection URI

Specifies the URI for the OAuth server to redirect a user back to the OAuth client. Displays when Grant Type is set to Authorization code.

Scope

Specifies one or more strings separated by spaces; for example contacts photo email. The strings are defined by the OAuth authorization server. Your best source of information for the strings that a particular OAuth authorization server defines could be APIs for OAuth 2.0 scopes on developer sites for OAuth providers.

For the Authorization code grant type, an OAuth authorization server prompts the user to grant or deny access to the scopes. For the Password grant type, an OAuth authorization server grants permission to the requested scopes based on the user providing resource owner password credentials.

The OAuth Scope agent makes requests to an OAuth authorization server to get scopes associated with a token and to get scope data, such as a user's email address or contact list. The OAuth Scope item provides these elements and options:

Server

Specifies an OAuth server. (OAuth servers in resource server, or client and resource server modes are available for selection.)

Scopes Request

Specifies a validation-scopes-request type request. This request type retrieves a list of scopes associated with the token.

There can be multiple scope data requests in this agent with these elements:

Scope Name

Specifies the name of a scope for which you are requesting data. (The external OAuth provider specifies the names of the scopes that it supports.)

Request

Specifies a scope-data-request type request. This is optional. If the provider does not require this type of request to obtain additional information from an authorization server, you do not need to fill in this field.

1. Create a developer account with the provider.
   Go to Google or Facebook developer sites or go to another OAuth provider site.
2. Log in to your developer account and add APM as a client application.
   Part of configuring APM as a client application should be to supply the provider with a redirect URI. The OAuth server uses it to redirect users back to APM OAuth client after they complete authorization. Type a URI that includes the FQDN for the virtual server you will configure on the BIG-IP system plus /oauth/client/redirect.
   Here is an example redirect URI: https://siterequest.com/oauth/client/redirect.

   Note: Type the correct scheme (HTTPS or HTTP) based on the settings for the virtual server.
3. Copy the IDs and secrets from the configuration and keep them handy.
   To configure APM as an OAuth client, you need to provide a client ID and client secret when you configure an OAuth server in APM.
   To configure APM as an OAuth resource server, you need to provide a resource server ID and resource server secret when you configure an OAuth server in APM.
   Note: Social media account providers supply only a client ID and client secret; you must use them for the client and resource server IDs and the client and resource server secrets in APM.

1. Add APM as a client application of the enterprise OAuth authorization server following instructions from the enterprise provider.
   Part of configuring APM as a client application should be to supply the provider with a redirect URI. The OAuth server uses it to redirect users back to APM OAuth client after they complete authorization. Type a URI that includes the FQDN for the virtual server you will configure on the BIG-IP system plus /oauth/client/redirect.
   Here is an example redirect URI: https://siterequest.com/oauth/client/redirect.

   Note: Type the correct scheme (HTTPS or HTTP) based on the settings for the virtual server.
2. Copy the IDs and secrets from the configuration and keep them handy.
   To configure APM as an OAuth client, you need to provide a client ID and client secret when you configure an OAuth server in APM.
   To configure APM as an OAuth resource server, you need to provide a resource server ID and resource server secret when you configure an OAuth server in APM.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > Provider .
   The Provider screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. From the Type field, select a predefined type of provider, or select Custom.
   If you select a predefined type, the additional fields fill with default values where possible.
5. In the Authentication URI field, type the URI on the provider where APM should redirect the user for authentication.
6. In the Token URI field, type the URI on the provider where APM can get a token.
7. In the Token Validation Scope URI field, type the URI on the provider where APM can get information about a specific token.
8. Click Finished.
   The new provider displays on the Provider screen.

A Mode setting in the OAuth server configuration specifies the OAuth roles that you intend Access Policy Manager^® (APM^®) to play: OAuth client, OAuth resource server, or OAuth client and resource server. You can configure OAuth servers for each or any of the modes on one BIG-IP^® system.

You might need to perform some SSL administration tasks to support communication between Access Policy Manager^® (APM^®) as an OAuth client and an OAuth resource server, and external OAuth authorization servers. OAuth server objects on APM require a server SSL profile for an OAuth client and for an OAuth resource server.

SSL certificates are configured in the System > Certificate Management > Traffic Certificate Management area of the product.

Server SSL profiles are configured in the Local Traffic > Profiles > SSL > Server area of the product.

For more information, refer to BIG-IP^® System: SSL Administration on the AskF5™ web site located at support.f5.com.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > OAuth Server .
   The OAuth Server screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. From the Mode list, select Client + Resource Server.
   APM can use this OAuth server to request access tokens and scope details, such as an email address for the user.
   The Client Settings and Resource Server Settings areas display.
5. From the Type list, to get OAuth authorization services from another BIG-IP^® system, retain the default selection F5; otherwise select another type.
   If any providers of the selected type exist, the OAuth Provider field displays one.
6. From the OAuth Provider list, retain the default selection or select another provider.
7. From the DNS Resolver list, select a DNS resolver (or click the plus (+) icon, create a DNS resolver, and then select it).
8. In the Token Validation Interval field, type a number.
   If you configure a per-request policy subroutine to validate the token, the subroutine repeats at this interval, or the expiry time of the access token, whichever is shorter.
9. In the Client Settings area, fill in these fields:
   You should have gotten a client ID and client secret when you registered APM as a client of the OAuth authorization server.
   1. In the Client ID field, type or paste the client ID.
   2. In the Client Secret field, type or paste the secret.
   3. From the Client's ServerSSL Profile Name, select a server SSL profile.
10. In the Resource Server Settings area, fill in these fields.
    You should have gotten an ID and secret from the OAuth authorization server when you registered APM with it.
    Note: Social account providers supply only client ID and client secret. For social account providers, use the client ID and client secret for the client and the resource server IDs and secrets.
    1. In the Resource Server ID field, type or paste the resource server ID (for an enterprise provider).
       For a social provider, type or paste the client ID instead.
    2. In the Resource Server Secret field, type or paste the resource server secret (for an enterprise provider).
       For a social provider, type or paste the client secret instead.
    3. From the Resource Server's ServerSSL Profile Name, select a server SSL profile.
11. Click Finished.
    The server displays on the OAuth Servers screen.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > OAuth Server .
   The OAuth Server screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. From the Mode list, select Client.
   In this mode, APM can request access tokens from this OAuth server; APM can also validate an existing access token and refresh it when expired on a per-request basis.
   The Client Settings area displays.
5. From the Type list, to get OAuth authorization services from another BIG-IP^® system, retain the default selection F5; otherwise select another type.
   If any providers of the selected type exist, the OAuth Provider field displays one.
6. From the OAuth Provider list, retain the default selection or select another provider.
7. From the DNS Resolver list, select a DNS resolver (or click the plus (+) icon, create a DNS resolver, and then select it).
8. In the Token Validation Interval field, type a number.
   If you configure a per-request policy subroutine to validate the token, the subroutine repeats at this interval, or the expiry time of the access token, whichever is shorter.
9. In the Client Settings area, fill in these fields:
   You should have gotten a client ID and client secret when you registered APM as a client of the OAuth authorization server.
   1. In the Client ID field, type or paste the client ID.
   2. In the Client Secret field, type or paste the secret.
   3. From the Client's ServerSSL Profile Name, select a server SSL profile.
10. Click Finished.
    The server displays on the OAuth Servers screen.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > OAuth Server .
   The OAuth Server screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. From the Mode list, select Resource.
   APM can use this OAuth server to request a list of scopes associated with the access token , request details for a particular scope, such as an email address for the user, or to make both types of requests.
   The Resource Server Settings area displays.
5. From the Type list, to get OAuth authorization services from another BIG-IP^® system, retain the default selection F5; otherwise select another type.
   If any providers of the selected type exist, the OAuth Provider field displays one.
6. From the OAuth Provider list, retain the default selection or select another provider.
7. From the DNS Resolver list, select a DNS resolver (or click the plus (+) icon, create a DNS resolver, and then select it).
8. In the Token Validation Interval field, type a number.
   If you configure a per-request policy subroutine to validate the token, the subroutine repeats at this interval, or the expiry time of the access token, whichever is shorter.
9. In the Resource Server Settings area, fill in these fields.
   You should have gotten an ID and secret from the OAuth authorization server when you registered APM with it.
   Note: Social account providers supply only client ID and client secret. For social account providers, use the client ID and client secret for the client and the resource server IDs and secrets.
   1. In the Resource Server ID field, type or paste the resource server ID (for an enterprise provider).
      For a social provider, type or paste the client ID instead.
   2. In the Resource Server Secret field, type or paste the resource server secret (for an enterprise provider).
      For a social provider, type or paste the client secret instead.
   3. From the Resource Server's ServerSSL Profile Name, select a server SSL profile.
10. Click Finished.
    The server displays on the OAuth Servers screen.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > Requests .
   APM supplies several preconfigured requests for these providers: F5 (APM), Facebook, Google, and Ping Identity (PingFederate).
2. To copy a request:
   Note: You cannot delete or update preconfigured requests. However, you can copy preconfigured requests and update the copies. You can also create new requests.
   1. Click the Copy link.
   2. In the New Request Name field, type a name.
   3. Click Copy.
      The Properties screen for the new request displays.
3. For the HTTP Method and Type settings, retain the existing values or select new ones.
4. To edit existing request parameters:
   1. From Request Parameters, select an entry and click Edit.
      The entry populates the Parameter Type and Parameter Name fields, and, for a custom parameter type, the Parameter Value field.
   2. Update the newly populated fields.
      Important: Do not configure a CODE, REFRESH_TOKEN, or STATE parameter. APM adds these parameters automatically when needed.
   3. Click Add.
      The updated request parameters display in the list.
5. Add, delete, or edit any request parameters.
6. To add a request header:
   1. In the Header Name field, type a name.
   2. In the Header Value field, type a value.
   3. Click Add.
   The entry displays in the Request Headers field.
7. Click Update.

1. On the Main tab, click Access > Federation > OAuth Client / Resource Server > Requests .
   APM supplies several preconfigured requests for these providers: F5, Facebook, Google, and Ping Identity (PingFederate).
2. Click Create.
3. In the Name field, type a name.
4. For HTTP Method, retain POST or select GET.
5. From the Type list, select a request type.
6. If you selected the scope-data-request type, type a URI in the URI field.
7. Specify request parameters:
   1. From Parameter Type, select an option.
      If you select custom, the Parameter Value field displays.
   2. In the Parameter Name field, type a name as specified by your provider.
      Important: Do not configure a CODE, REFRESH_TOKEN, or STATE parameter. APM adds these parameters automatically when needed.
   3. In the Parameter Value field, type a value.
   4. Click Add.
      The entry displays in the Request Parameters field.
8. Add request headers if needed:
   1. In the Header Name field, type a name.
   2. In the Header Value field, type a value.
   3. Click Add.
   The entry displays in the Request Headers field.
9. Click Finished.

The table lists OAuth request types, and specifies the agents that use them and the policies where they are used.

The OAuth provider, server, and request objects are ready for use in OAuth Client and OAuth Scope agents in access policies and per-request policy subroutines.

To obtain an access token one time only for the session, you need to configure an access policy. The OAuth Client agent can request a token.

With this access policy, the user logs on through a BIG-IP^® system. The OAuth Client agent obtains an access token, and an OAuth Scope agent tries to retrieve the list of scopes associated with the token from the OAuth provider. The session starts. When the token expires, the system makes no attempt to refresh it.

To obtain an access token and to validate it for each request, first you need an access policy to obtain the token.

Access policy for APM as an OAuth client and resource server

To periodically validate and refresh the token, you need a per-request policy subroutine.

When Access Policy Manager^® (APM^®) acts as an OAuth resource server, an OAuth Scope agent validates tokens obtained from the incoming request.

Per-request policy runs for each request, while subroutine runs only at an interval

The access profile type dictates which policy agents are available for use in an access policy. The access policy agents that Access Policy Manager^® (APM^®) uses to make requests as an OAuth client or OAuth resource server are available when you configure access policies for these access profile types:

• LTM-APM: For a web access management configuration.
• SSL-VPN: For network access, portal access, or application access configurations.
• ALL: For LTM-APM and SSL-VPN access types.
• SWG - Explicit: For explicit forward proxy.
• SWG - Transparent: For transparent forward proxy.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.
   The New Profile screen opens.
3. In the Name field, type a name for the access profile.
   Note: An access profile name must be unique among all access profile and any per-request policy names.
4. From the Profile Type list, select one these options:
   • LTM-APM: Select for a web access management configuration.
   • SSL-VPN: Select to configure network access, portal access, or application access. (Most access policy items are available for this type.)
   • ALL: Select to support LTM-APM and SSL-VPN access types.
   • SWG - Explicit: Select to configure access using Secure Web Gateway explicit forward proxy.
   • SWG - Transparent: Select to configure access using Secure Web Gateway transparent forward proxy.
   Note: Depending on licensing, you might not see all of these profile types.
   Additional settings display.
5. In the Language Settings area, add and remove accepted languages, and set the default language.
   A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
6. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Authentication tab, select OAuth Client.
5. Click Add Item.
   The screen is not active while the visual policy editor creates the action. The screen closes and a Properties screen opens.
6. In the Name field, type a name for the policy item.
   This name is displayed in the action field for the policy.
7. From the Server list, select an OAuth server.
   Only OAuth servers configured with Mode set to Client or Client + Resource Server display.
8. From the Grant Type list, select one of these options:
   • Authorization code - Redirects the user to the external server to authenticate. The user is redirected back to APM with an authorization code. APM uses the authorization code to request an access token
   • Password - Requests an access token from the external server by using the user's credentials (username and password). If this method is configured, the user must provide their external credentials to APM; to make this happen you must insert a logon page before the OAuth Client item in the access or the per-request policy.
   If you select Authorization code, the Redirection URI field displays.
9. Select the requests to make to the OAuth server from the access policy.
   • Authentication Redirect Request - Specifies an auth-redirect-request type request, which redirects a user to an OAuth server. Displays when Grant Type is set to Authorization code.
   • Token Request - Specifies a token-request type of request.
   You can make selections from the Refresh Token Request and Validate Token Request lists, but the OAuth Client does not use these requests from an access policy.
   Requests are configured in the Access > Federation > OAuth Client / Resource Server > Requests area of the product.
10. If the Redirection URI field displays, retain the default value (https://%{session.server.network.name}/oauth/client/redirect) or type a URI that points back to the APM client.
    Important: If you type a URI, you must retain this path /oauth/client/redirect. Only change the host name portion of the URI.
    The OAuth server uses the URI to send the user back to APM.
11. In the Scope field, type one or more scopes separated by spaces.
    Note: Each time you add another OAuth Client agent to a policy, you must include the scopes (for example, email photos) that were requested in the previous instance of the OAuth Client and append any additional scopes (for example, contacts) to the list (for example, email photos contacts).
    Read the OAuth provider documentation to learn the names of the scopes that they support and the URIs where you can obtain the data.
12. Click Save.
    The Properties screen closes. The newly added item displays in the policy.
13. If you selected Password from the Grant Type list, you must insert a logon page agent to precede the OAuth Client agent.
    1. Click (+) ahead of the OAuth Client on the policy branch.
    2. On the Logon Page tab, select OAuth Logon Page and click Add Item.
       A Properties screen displays.
    3. Click Save.
       The properties screen closes. The policy displays.
14. Complete the policy:
    1. Add any branch rules that you need.
       By default, the OAuth Client item has a successful branch for any valid non-error JSON response it receives. However, you can add other branch rules based on authorization server response to suit your needs.
    2. Change branch endings as needed; change Deny to Allow where you want to provide access.
15. Click the Apply Access Policy link to apply and activate the changes to the policy.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Authentication tab, select OAuth Scope.
5. Click Add Item.
   The screen is not active while the visual policy editor creates the action. The screen closes and a Properties screen opens.
6. In the Name field, type a name for the policy item.
   This name is displayed in the action field for the policy.
7. From the Server list, select an OAuth server.
   Only OAuth servers configured with Mode set to Resource Server or Client + Resource Server display.
8. To get a list of scopes associated with an access token, from the Scopes Request list, select a request to send to the OAuth provider.
   The list displays validation-scopes-request types.
   If F5 (APM) is the OAuth provider, select F5ScopesRequest.
   Requests are configured in the Federation > OAuth Client / Resource Server > Requests area of the product.
9. To add requests for scope data (for example, to request a user's email address or profile), perform these steps:
   1. Click Add new entry.
      A new line is added to the list of entries.
   2. In the Scope Name field, type the name of a scope that the OAuth provider supports.
      The scope must be associated with the access token. (The user must have granted permission for this scope.)
      For example, some OAuth providers support scopes named email or profile.
   3. From the Request list, select a request.
      The list includes scope-data-request types. Select one that you configured to meet the requirements of the specific OAuth provider.
10. Click Save.
    The Properties screen closes. The newly added item displays in the policy.
11. Complete the policy:
    1. Add any additional policy items you require.
    2. Change the ending from Deny to Allow on any access policy branch on which you want to grant access.
12. Click the Apply Access Policy link to apply and activate the changes to the policy.

A per-request policy runs at each request. A per-request policy subroutine runs periodically at whichever of these intervals is shorter: the number of minutes specified in the OAuth server Token Validation Interval field on Access Policy Manager^® (APM^®), or the interval that the external OAuth authentication server specifies in the expires_in attribute of the access token it issues.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
3. Click the Add New Subroutine button.
   A popup screen opens.
4. On the Subroutine from template list, retain the selection Empty, and click Save.
   The popup screen closes. The subroutine, with the heading [+] Subroutine: Name , displays below the main editor.
5. Expand the subroutine by clicking the [+] icon.
   The subroutine displays.
6. Click the (+) icon anywhere in the subroutine to add a new item.
   A small set of actions are provided for building a subroutine.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
7. On the Authentication tab, select OAuth Client.
8. Click Add Item.
   The screen is not active while the visual policy editor creates the action. The screen closes and a Properties screen opens.
9. In the Name field, type a name for the policy item.
   This name is displayed in the action field for the policy.
10. From the Server list, select an OAuth server.
    Only OAuth servers configured with Mode set to Client or Client + Resource Server display.
11. From the Grant Type list, select one of these:
    • Authorization code - Redirects the user to the external server to authenticate. The user is redirected back to APM with an authorization code. APM uses the authorization code to request an access token
    • Password - Requests an access token from the external server by using the user's credentials (username and password). If this method is configured, the user must provide their external credentials to APM; to make this happen, you must insert a logon page before the OAuth Client item in the access or the per-request policy.
      Note: If you select the password grant type, every time the per-request policy subroutine runs, it must request credentials from the user.
12. Select requests for the per-request policy to make to the OAuth server.
    • Authentication Redirect Request - Specifies an auth-redirect-request type request, which redirects a user to an OAuth server. Displays when Grant Type is set to Authorization code.
    • Token Request - Specifies a token-request type of request.
    • Refresh Token Request - Specifies a token-refresh-request type of request.
    • Validate Token Request - Specifies a validation-scopes-request type of request, which can get a list of scopes for an existing token and get data for the scopes.
      Note: If F5 (APM) is the OAuth provider, select F5TokenValidation.
    Requests are configured in the Access > Federation > OAuth Client / Resource Server > Requests area of the product.
13. If the Redirection URI field displays, retain the default value (https://%{session.server.network.name}/oauth/client/redirect) or type a URI that points back to the APM client.
    Important: If you type a URI, you must retain this path /oauth/client/redirect. Only change the host name portion of the URI.
    The OAuth server uses the URI to send the user back to APM.
14. In the Scope field, type one or more scopes separated by spaces.
    Note: Each time you add another OAuth Client agent to a policy, you must include the scopes (for example, email photos) that were requested in the previous instance of the OAuth Client and append any additional scopes (for example, contacts) to the list (for example, email photos contacts).
    Read the OAuth provider documentation to learn the names of the scopes that they support and the URIs where you can obtain the data.
15. Click Save.
    The Properties screen closes. The newly added item displays in the policy.
16. If you selected Password from the Grant Type list, you must insert a logon page agent to precede the OAuth Client agent.
    1. Click (+) ahead of the OAuth Client on the policy branch.
    2. On the Logon Page tab, select OAuth Logon Page and click Add Item.
       A Properties screen displays.
    3. Click Save.
       The properties screen closes. The policy displays.
17. Complete the policy:
    1. Add any branch rules that you need.
       By default, the OAuth Client item has a successful branch for any valid non-error JSON response it receives. However, you can add other branch rules based on authorization server response to suit your needs.
    2. Change branch endings as needed; change Deny to Allow where you want to provide access.
18. Add the subroutine to the per-request policy:
    1. On a per-request policy branch, click the (+) icon.
    2. Select the Subroutines tab.
    3. Select the subroutine and click Add Item.
       The popup screen closes and the policy displays.
19. To rename the subroutine or to update number of seconds that the subroutine has to complete its interactions with the OAuth server, perform these steps:
    1. Click Subroutine Settings/Rename.
    2. To rename the subroutine, type in the Name field.
    3. To update the timeout, type a number in the Subroutine Timeout (sec) field.
       Important: No additional settings on this screen are applicable to the OAuth Client and OAuth Scope items.
    4. Click Save.
       The popup screen closes. The subroutine displays in the policy.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
3. Click the Add New Subroutine button.
   A popup screen opens.
4. On the Subroutine from template list, retain the selection Empty, and click Save.
   The popup screen closes. The subroutine, with the heading [+] Subroutine: Name , displays below the main editor.
5. Expand the subroutine by clicking the [+] icon.
   The subroutine displays.
6. Click the (+) icon anywhere in the subroutine to add a new item.
   A small set of actions are provided for building a subroutine.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
7. On the Authentication tab, select OAuth Scope.
8. Click Add Item.
   The screen is not active while the visual policy editor creates the action. The screen closes and a Properties screen opens.
9. In the Name field, type a name for the policy item.
   This name is displayed in the action field for the policy.
10. From the Server list, select an OAuth server.
    Only OAuth servers configured with Mode set to Resource Server or Client + Resource Server display.
11. From the Server list, select an OAuth server.
    Only OAuth servers configured with Mode set to Client or Client + Resource Server display.
12. To get a list of scopes associated with an access token, from the Scopes Request list, select a request to send to the OAuth provider.
    The list displays validation-scopes-request types.
    If F5 (APM) is the OAuth provider, select F5ScopesRequest.
    Requests are configured in the Federation > OAuth Client / Resource Server > Requests area of the product.
13. To add requests for scope data (for example, to request a user's email address or profile), perform these steps:
    1. Click Add new entry.
       A new line is added to the list of entries.
    2. In the Scope Name field, type the name of a scope that the OAuth provider supports.
       The scope must be associated with the access token. (The user must have granted permission for this scope.)
       For example, some OAuth providers support scopes named email or profile.
    3. From the Request list, select a request.
       The list includes scope-data-request types. Select one that you configured to meet the requirements of the specific OAuth provider.
14. Click Save.
    The Properties screen closes. The newly added item displays in the policy.
15. Add the subroutine to the per-request policy:
    1. On a per-request policy branch, click the (+) icon.
    2. Select the Subroutines tab.
    3. Select the subroutine and click Add Item.
       The popup screen closes and the policy displays.
16. To rename the subroutine or to update number of seconds that the subroutine has to complete its interactions with the OAuth server, perform these steps:
    1. Click Subroutine Settings/Rename.
    2. To rename the subroutine, type in the Name field.
    3. To update the timeout, type a number in the Subroutine Timeout (sec) field.
       Important: No additional settings on this screen are applicable to the OAuth Client and OAuth Scope items.
    4. Click Save.
       The popup screen closes. The subroutine displays in the policy.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Service Port field, type 443 or select HTTPS from the list.
5. From the HTTP Profile list, select http.
6. For the SSL Profile (Client) setting, from the Available list, select clientssl, and using the Move button, move the name to the Selected list.
7. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server that manages access for the web application you are securing.
3. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
4. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
5. Click Update.

The OAuth Logon Page advanced customization template provides the code and the images necessary to display a logon page that, by default, looks like this.

OAuth Logon Page (advanced customization template)

The template forms a starting point for additional customization to achieve a logon page with the preferred providers, images, colors, fields, and text.

The OAuth Logon Page template is available for download from DevCentral™ at devcentral.f5.com. Instructions for advanced customization with the OAuth Logon Page template are also available in BIG-IP^® Access Policy Manager^®: Advanced Customization Examples on DevCentral.

1. Open the per-session policy (or the per-request policy subroutine) that you want to update.
2. Click the OAuth Logon Page item.
   A Properties screen opens.
3. In row 1 of the Logon Page Agent table, click the Values field.
   Row 1 contains values for the oauthprovidertype variable.
   A popup screen displays options with a Value and a Text field for each provider.
4. Add, delete, or reorder the providers, and click Finished.
   The popup screen closes. The updated list of providers displays in the Values field in row 1.
5. If you added a provider, add a branch rule for that provider:
   1. Click the Branch Rules tab.
   2. Click Add Branch Rule.
      A new entry with Name and Expression settings displays.
   3. In the Name field, replace the default name by typing a new name.
      The name appears on the branch in the policy.
   4. Select and copy an expression from another branch rule.
      For example, copy the expression displayed for the F5 branch rule:

                                          
      expr {[mcget {session.logon.last.oauthprovidertype}] == "F5"}

   5. For the branch rule that you added, in the Expression setting click the change link.
      A popup screen opens.
   6. Click the Advanced tab, paste the expression into the field, and replace the existing provider name (such as F5) with the new provider name.
      For example, the result might look like this:

                                          
      expr {[mcget {session.logon.last.oauthprovidertype}] == "Siterequest"}

   7. Click Finished.
      The popup screen closes.
   8. Click Save.
      The properties screen closes and the policy displays.
6. Click Finished.
   The popup screen closes.
7. If you are working with a per-session policy, click the Apply Access Policy link.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.
   The New Profile screen opens.
3. In the Name field, type a name for the access profile.
   Note: An access profile name must be unique among all access profile and any per-request policy names.
4. From the Profile Type list, select OAuth-Resource Server.
   The User Identification Method setting changes to OAuth Token.
5. In the Language Settings area, add and remove accepted languages, and set the default language.
   A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
6. Click Finished.

1. Open the access policy in the visual policy editor:
   1. On the Main tab, click Access > Profiles / Policies > Access Profiles (Per-Session Policies) .
      The screen displays a list of access profiles.
   2. Locate the correct access profile.
      Look in the Profile Type field for OAuth-Resource Server.
   3. In the Per-Session Policy field, click the Edit link.
      The visual policy editor opens the access policy in a separate screen.
2. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
3. To review the subset of agents that are allowed for use with the OAuth-Resource Server access profile type, click each tab.
4. To add an OAuth Scope agent to the access policy:
   1. On the Authentication tab, select OAuth Scope.
   2. From the Server list, select an OAuth server that you know to be configured with Mode set to Resource Server.
      Important: Do not select an OAuth server configured with Mode set to Client + Resource Server.
   3. From the Scopes Request list, select a request.
      Only validate-scopes-request type requests display.
      If F5 (APM) is the OAuth provider, select F5ScopesRequest.
   4. To add scope data requests, click Add new entry and, in the Scope Name field, type the name of a scope that the OAuth provider supports; then, from the Request list, select a scope data request that was configured to meet the requirements of the OAuth provider.
   5. Click Save.
      The properties screen closes. The policy displays.
5. To save and apply any changes that you made to the access policy, click Apply Access Policy.
6. To add an OAuth Scope agent to a per-request policy subroutine:
   1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   2. To open a per-request policy for editing, click the Edit link in the Per-Request Policy field.
      Note: If you must create a per-request policy first, provide a name for it that is unique among all access profiles and per-request policies.
   3. Click Add New Subroutine.
      A popup screen opens. The Subroutine from template field specifies Empty.
   4. Click Save.
      The popup screen closes. The heading, [+] Subroutine: Name , displays below the main editor.
   5. Expand the subroutine for editing by clicking the [+] icon.
   6. In the subroutine area, click [+].
      An Add Item popup screen opens.
   7. On the Authentication tab, select OAuth Scope and click Add Item.
   8. To configure the OAuth Scope agent properties, follow the instructions provided in this task previously.
   9. To add the subroutine to the per-request policy, in the main editor click the [+] icon.
   10. Click the Subroutines tab, select the subroutine, and click Add Item.
       The subroutine displays in the per-request policy.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Service Port field, type 443 or select HTTPS from the list.
5. From the HTTP Profile list, select http.
6. For the SSL Profile (Client) setting, from the Available list, select clientssl, and using the Move button, move the name to the Selected list.
7. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server that manages access for the web application you are securing.
3. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
4. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
5. Click Update.

1. On the Main tab, select Access > Single Sign-On > OAuth Bearer .
   The OAuth Bearer Configurations screen opens.
2. Click Create.
   The New SSO Configuration screen opens.
3. In the Name field, type a name for the SSO configuration.
4. In the SSO Method Configuration area, select a server from the OAuth Server list.
5. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. Click SSO / Auth Domains on the menu bar.
   The SSO Across Authentication Domains screen opens.
4. From the SSO Configurations list, select an OAuth bearer SSO configuration.
   Other settings on the screen are not relevant when using an OAuth bearer SSO configuration.
5. Click Update.

1. On the Main tab, click Access > Overview > OAuth Reports > Client / Resource Server .
   The x-axis for the chart specifies time. The y-axis specifies the rate: requests per second.
   The screen displays the Overview line graph with data from the last hour. The legend specifies the request types represented by each colored line; Error represents errors that occurred for any of the requests.
2. To display the rate of requests for the interval represented by a point in the chart, place your cursor at the point in the chart.
   The legend updates to display the rates.
3. To get the number of requests for a point in the chart, multiply the rate by the number of seconds in the interval.
   The interval between two consecutive points on a chart depends on the selected Time.
4. To generate the chart for another period of time, select one from the Time list.

The interval between two consecutive points in an OAuth performance chart depends on the time period selected for the chart.