As defined in the OAuth 2.0 specification (RFC 6749), an access token is a credential used to access protected resources. An access token is a string that represents an authorization issued to the client. A token represents specific scopes and durations of access granted by the resource owner. The resource server and the authorization server enforce the scopes and durations of access.

As defined in the OAuth 2.0 specification (RFC 6749), a refresh token is a credential used to obtain an access token. The client uses a refresh token to get a new access token from the authorization server when the current access token expires. If refresh tokens are enabled in the configuration, the OAuth authorization server issues a refresh token to the client when it issues an access token.

A refresh token is a string. It represents the authorization that the resource owner grants to the client. Unlike access tokens, a refresh token is for use with authorization servers only, and is never sent to a resource server.

Opaque tokens are issued in a proprietary format. Only the OAuth authorization server that issues the token can read it and validate it. The OAuth authorization server stores an opaque token for its lifetime and offers the ability to revoke the token. Use of opaque tokens forces client apps to communicate with the authorization server.

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information in a JSON object between OAuth entities. This information can be verified and trusted because it is digitally signed. JSON tokens are not stored on an OAuth authorization server and they cannot be revoked.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > Client Application .
   The Client Application screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. In the Application Name field, type the application name.
5. In the Customization Settings for English area in the Caption field, type a caption.
   APM displays this caption as the name of the application on an Authorization screen if you choose to display one.
6. In the Security Settings area, for Authentication Type, select one of the options:
   • None - This is typically used in conjunction with the Implicit grant type, which does not use a secret or a certificate. For grant types other than Implicit, the other options provide better security.
   • Secret - This is the default setting. If this is selected, APM generates this secret for the client and you can request that APM regenerate the secret.
   • Certificate - Uses the client certificate. If this is selected, the Client Certificate Distinguished Name field displays.
7. If the Client Certificate Distinguished Name field displays, leave it blank or type a name.
   If you leave it blank, APM accepts any valid client certificate. If you specify a name, APM accepts only the specific valid client certificate with the specified Distinguished Name.
   This is a sample Distinguished Name for the client certificate: emailAddress=w.smith@f5.com,CN=OAuth AS Project Client2 Cert,OU=Product Development,O=F5 Networks,ST=CA,C=US
8. For Scope, select one or more and move them to the Selected field.
9. From Grant Type, select one or more of the options:
   • Authorization Code - The client must authenticate with the authorization server (APM) to get a token.
   • Implicit - The client gets a token from the authorization server (APM) without authenticating to it. (Refresh tokens are not available with this grant type.)
   • Resource Owner Password Credentials - The client goes directly to the authorization server and uses the resource owner credentials to obtain a token.
10. For Redirect URI(s) (if displayed), type a fully qualified URI, click Add, and repeat as needed.
    Redirect URI(s) form a list of URIs to which the OAuth authorization server can redirect the resource owner’s user agent after authorization is obtained for an authorization code or implicit grant type.
11. To apply the token management settings from an OAuth profile, perform these substeps:
    1. In the Token Management Configuration area, retain selection of the Enabled check box.
       The token management configuration settings in an OAuth profile apply to client applications assigned to that profile except when this setting is disabled.
    2. Skip to step 13.
12. To manage tokens in a manner that is distinct for this client application, perform these substeps:
    1. In the Token Management Configuration area, clear the Enabled check box.
       Additional fields display.
    2. Update any of the additional fields.
13. Click Finished.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > Resource Server .
   The Resource Server screen displays.
2. Click Create.
3. In the Name field, type a name for the object.
4. For Authentication Type, select one of these:
   • None - This option requires no authentication when the resource server sends a token introspect request to the OAuth authorization server to get the token validated.
   • Secret - For this option, APM generates this secret and you can request that APM regenerate the secret.
   • Certificate - This is the default setting. If this is selected, Resource Server Certificate Distinguished Name field displays.
5. If Resource Server Certificate Distinguished Name displays, leave it blank or type a name.
   If you leave it blank, APM accepts any valid client certificate. If you specify a name, APM accepts only the specific valid client certificate with the specified Distinguished Name.
   This is a sample Distinguished Name for the client certificate: emailAddress=w.smith@f5.com,CN=OAuth AS Project Client2 Cert,OU=Product Development,O=F5 Networks,ST=CA,C=US
6. Click Finished.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > Scope .
   The Scope screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. In the Scope Name field, type a name for the scope.
5. In the Scope Value field, type a value for the scope.
6. In the Customization Settings for English area, in the Caption field, type a caption.
7. In the Detailed Description field, type a description of the access that the client application needs.
   If you choose to display an Authorization screen, APM displays the contents of this field on it; or, if this field is blank, APM displays the contents of the Caption field.
   Here are some examples: Access your profile or Update your tasks, projects, and workspace.
8. Click Finished.

1. On the Main tab, select Access > Federation > OAuth Authorization Server > Claim .
2. Click Create.
3. In Name, type a name for the configuration.
4. In Claim Name, type a name for the claim.
5. In Claim Value, type a value for the claim.
6. Click Save.
   The newly created claim displays on the list.

1. On the Main tab, select Access > Federation > JSON Web Token > Key Configuration .
   The Key Configuration screen opens.
2. Click Create.
3. In the Name field, type a name.
4. In ID, type the ID.
5. For Type, select RSA, Octet, or Elliptic Curve.
   Additional parameters display for the type that you select.
6. For Signing Algorithm, select any one.
7. For the Octet type, you only need to configure one additional setting:
   1. In Shared Secret, type the secret.
      Important: To maximize the security of the algorithm, type enough characters so that the resulting key size matches the block size for the signing algorithm: for HS256, 32 characters; for HS384, 48 characters; for HS512, 64 characters.
   2. Click Save.
      The newly created JWK displays on the list.
8. For the RSA or Elliptic Curve key types, configure the settings in the Certificate areas:
   1. For Certificate File, select a certificate.
      Important: Do not select the default certificate when the BIG-IP^® system is on a chassis platform or is included in an HA pair. F5 strongly discourages the use of the default certificate in a JWK in any configuration.
   2. To include an X5C (X.509 Certificate Chain) parameter in the JWKS response from the OAuth authorization server JWKS endpoint, select Include X5C.
   3. For Certificate Key, select one.
      Important: Do not select the default key when the BIG-IP system is on a chassis platform or is included in an HA pair. F5 strongly discourages the use of the default key in a JWK in any configuration.
   4. For Key Passphrase, type a passphrase.
   5. For Certificate Chain, select one.
9. Click Save.
   The newly created JWK displays on the list.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > Database Instance .
   The Database Instance screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. In the Purge Schedule Settings area, select a frequency from the Frequency list and specify a time in the Schedule At field.
   Schedule the database purge for a time when the BIG-IP^® system is least used to prevent any possible performance issues.
   Purging removes expired access tokens, refresh tokens, authorization codes, and associated entries from the instance. For the purpose of purging, an access token is considered expired when it passes the date when it expires; (expiry is based on the Access Token Lifetime setting).
   Note: Expired access tokens are not removed when the Reuse Access Token setting is enabled (in the corresponding OAuth profile) and a refresh token has been issued and the refresh token is not expired.
   Revoked access tokens are purged after they expire.
5. To save this database instance, click Finished.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > OAuth Profile .
   The OAuth Profile screen opens.
2. Click Create.
3. In the Name field, type a name for the object.
4. For Client Application, select from the available clients and move them to the Selected list.
5. For Resource Server, select from the available servers and move them to the Selected list.
6. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.
   The New Profile screen opens.
3. In the Name field, type a name for the access profile.
   Note: A access profile name must be unique among all access profile and any per-request policy names.
4. From the Profile Type list, select All or LTM-APM.
5. Scroll down to the Configurations area.
6. From the OAuth Profile list, select the OAuth profile you configured earlier.
7. In the Language Settings area, add and remove accepted languages, and set the default language.
   A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
   Important: If you want to translate text into other languages (as you can in Access Policy Customization), make sure to select the languages that you want to display here.
8. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
5. Click Save.
   The properties screen closes and the policy displays.
6. On a policy branch, click the (+) icon to add an item to the policy.
7. On the Authentication tab, select OAuth Authorization and click Add Item.
   Important: You must include an OAuth Authorization item in the policy for it to work.
   A Properties popup screen opens.
8. If you do not want to prompt for authorization, in the OAuth Authorization area, from the Prompt for Authorization list, select Disabled.
9. In the Subject field, type the subject.
   This is the subject of a JSON web token (JWT).
10. In the Audience area, for each audience that you want to support for JWT:
    1. Click Add new entry.
       A numbered entry displays.
    2. Type an audience name in the new field.
11. In the Scope / Claim Assign area, add entries to assign scopes, claims, or both:
    Assign these whether or not you plan to prompt for authorization.
    1. Click Add new entry.
       A numbered entry displays with Expression and Claim and Scope properties.
    2. To specify a prerequisite for the scopes and claims, click change and configure an expression.
       A prerequisite is not mandatory.
       For example, use an expression to verify that the user has passed an LDAP query for membership in a group. Or verify that the user has passed Active Directory authentication.
    3. To add claims and scopes, click Add/Delete; (this opens a popup screen with Scope and Claim tabs); on one or both tabs, select entries and click Update (this closes the popup screen).
12. Click Save.
    The properties screen closes and the policy displays.
13. Add any additional access policy items you require to complete the access policy.
    Note: On the branch of the access policy with OAuth Authorization, do not also assign connectivity resources (as you can with various resource assign access policy items). Doing so causes a validation error on the Allow ending.
14. Change the ending from Deny to Allow on any access policy branch on which you want to grant access.
15. Click the Apply Access Policy link to apply and activate the changes to the policy.

1. On the Main tab, click Local Traffic > Profiles > SSL > Client .
   The Client SSL profile list screen opens.
2. Click Create.
   The New Client SSL Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. From the Parent Profile list, select clientssl.
5. Scroll down to the Client Authentication area.
6. Next to Client Authentication, select the Custom check box.
   The settings become available.
7. From the Client Certificate list, retain the default setting ignore.
   Selecting ignore prevents traffic from OAuth client applications and OAuth resource servers from being blocked if they are configured to use a secret for authentication or to use no authentication at all. The BIG-IP^® system still requests a certificate from any OAuth client application or OAuth resource server that specifies a certificate type of authentication.
8. From the Trusted Certificate Authorities list, make a selection.
   The BIG-IP system supplies a default certificate and a ca-bundle.crt file that includes all well-known public certificate authority (CA) certificates for client-side processing.
9. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Service Port field, type 443 or select HTTPS from the list.
4. From the HTTP Profile list, select http.
5. For the SSL Profile (Client) setting, move the client SSL profile you created earlier to the Selected list.
6. Scroll down to the Access Profile area.
7. From the Access Profile list, select the access profile you created earlier.
8. Click Finished.

1. On the Main tab, click Access > Profiles / Policies > Customization > General .
   The Customization tool appears in General Customization view, displaying Form Factor: Full/Mobile Browser settings.
2. In the left pane, select the Text tab.
   A navigation tree displays in the left pane.
3. Expand the OAuth Client Applications folder.
4. Click the name of the OAuth client application you want to customize.
   The partition precedes the client application name, for example /Common/myClientApp.
   A table displays Name (setting name) and Value (display text) in the right pane.
5. From the Language list above the table, select a language.
6. To supply text or to replace existing text for Caption:
   1. Click in the Value field.
      A pencil icon displays at the end of the field.
   2. Type your translated text and press Enter.
7. To supply text or to replace existing text for Detailed Description:
   1. Click in the Value field.
      A pencil icon displays at the end of the field.
   2. Type your translated text and press Enter.
8. Click the Save icon.
9. To customize text for additional languages, select a language, make the changes that you require, and click Save before you select another language.

1. On the Main tab, click Access > Profiles / Policies > Customization > General .
   The Customization tool appears in General Customization view, displaying Form Factor: Full/Mobile Browser settings.
2. In the left pane, select the Text tab.
   A navigation tree displays in the left pane.
3. Expand the OAuth Scopes folder.
4. Click the name of the OAuth scope that you want to localize.
   The partition where the scope resides precedes the scope name, for example Common/myEmailScope.
   A table displays Name (setting name) and Value (display text) in the right pane.
5. From the Language list above the table, select a language.
6. To supply text or to replace existing text for Caption:
   1. Click in the Value field.
      A pencil icon displays at the end of the field.
   2. Type your translated text and press Enter.
7. To supply text or to replace existing text for Detailed Description:
   1. Click in the Value field.
      A pencil icon displays at the end of the field.
   2. Type your translated text and press Enter.
8. Click the Save icon.
9. To customize text for additional languages, select a language, make the changes that you require, and click Save before you select another language.

If an access or per-request policy agent supports customization, customization settings are available in agent properties from within the visual policy editor. The same customization settings are also available for the agent in the Access > Profiles / Policies > Customization area of the BIG-IP^® system. For more information, see BIG-IP^® Access Policy Manager^® (APM^®) Customization on the AskF5™ web site located at support.f5.com.

1. On the Main tab, click Access > Overview > OAuth Reports > Tokens .
   The OAuth Tokens screen opens. By default, the /Common/oauthdb/ default database instance is selected. The display initially places the most recently issued access tokens at the top of the table.
2. Locate the access tokens that you want to delete using any or all of these methods:
   1. From the DB Instance list, select the database instance where the client app or the resource server stores tokens.
      If you have few database instances, you might search them in turn for the access tokens that you want to revoke.
      The OAuth profiles that are associated with client apps and resource servers specify which database instance to use.
   2. In the Search field, type all or part of a user name or client application name and press Enter.
      Any results that match display.
   3. Sort the tokens by clicking a table heading, such as Client App or Access Token Issued.
3. Select the access tokens that you want to revoke.
4. Click Revoke.
   A popup screen displays a confirmation message.
5. On the popup screen, click Revoke.

1. On the Main tab, click Access > Federation > OAuth Authorization Server > Database Instance .
   The Database Instance screen opens.
2. In the Name field, click the name of a database instance.
   A Properties screen opens.
3. To purge the database immediately, below the Purge Schedule Settings area, click Purge Now.
4. To specify a schedule for regular database purging, perform these steps:
   1. Select a frequency from the Frequency list.
   2. Specify a time in the Schedule At field.
   1. Click Update.

1. Log on to the command line of the BIG-IP system.
2. Open the TMOS Shell (tmsh).
   tmsh
3. Type this command: show apm oauth purged-entries.
   A list of OAuth IDs displays with the dates and times on which access tokens were purged.

    oauth_id                                                purged_time
---------------------------------------------------------------------------
07c64b01e360f43ff4e2b561107de9f4aa5ca14e54b5e72e        2016-09-29 02:00:01

1. On the Main tab, click Access > Overview > OAuth Reports > Server .
   The Overview chart summarizes OAuth authorization server activity. Additional charts provide statistics by grant type.
   The x-axis for a chart specifies time. The y-axis specifies the rate: requests per second.
   The screen displays OAuth server performance charts with data from the last hour.
2. To display the rate of requests for the interval represented by a point in a chart, place your cursor at the point in the chart.
   The legend updates to display the rates.
3. To get the number of requests for a point in the chart, multiply the rate by the number of seconds in the interval.
   The interval between two consecutive points on a chart depends on the selected Time.
4. To generate charts for another time period, select one from the Time list.

The interval between two consecutive points in an OAuth performance chart depends on the time period selected for the chart.

1. On the Main tab, click Access > Overview > OAuth Reports > Tokens .
   The OAuth Tokens screen opens. By default, the /Common/oauthdb/ default database instance is selected. The display initially places the most recently issued access tokens at the top of the table.
2. Use the fields at the top of the screen (DB Instance, Access Token Issued, and Search) to select a database instance, to change the time period, or to type part of a user or client application name and search for it.
   The screen updates with data to match the filters you set.
3. To view the scopes associated with an access token:
   1. Click the link in the Scopes column.
      A popup screen displays the list of scopes.
   2. Click OK.
4. To view the user agents associated with an access token:
   1. Click the link in the User Agents column.
      A popup screen displays the list of scopes.
   2. Click OK.
5. To sort the access tokens by Client App, User, User Agent, or any other table column, click the table column name.
6. To page through the report, use the fields at the bottom of the screen.

The OAuth access token report displays a status for each opaque access token. This table defines each status.