Latest update: 7.0.2
- Preface
- About IG
- IG As an HTTP Gateway
- Processing Requests and Responses
- Development Mode and Production Mode
- Decorators
- Configuration Parameters Declared as Property Variables
- Changing the Configuration and Restarting IG
- Understanding IG APIs With API Descriptors
- Sessions
- Secrets
- Installation in Detail
- About Securing Connections
- Installing IG in Standalone Mode
- Installing IG in Apache Tomcat
- Installing IG in Jetty
- Installing IG in JBoss EAP
- Preparing the Network
- Changing the Default Location of the Configuration Folders
- Preparing For Load Balancing and Failover
- Configuring IG For HTTPS (Client-Side)
- Using JWT Sessions
- Setting Up AM
- Getting Login Credentials From Data Sources
- Getting Login Credentials From AM
- Single Sign-On and Cross-Domain Single Sign-On
- Enforcing Policy Decisions From AM
- Hardening Authorization With Advice From AM
- Protecting Against CSRF Attacks
- Acting As a SAML 2.0 Service Provider
- Acting As an OAuth 2.0 Resource Server
- Acting As an OpenID Connect Relying Party
- Transforming OpenID Connect ID Tokens Into SAML Assertions
- Supporting UMA Resource Servers
- Configuring Routers and Routes
- Proxying WebSocket Traffic
- Implementing Not-Enforced URIs for Authentication
- Configuration Templates
- Extending IG
- Throttling the Rate of Requests to Protected Applications
- SAML 2.0 and Multiple Applications
Acting As an OAuth 2.0 Resource Server
The following sections describe how IG acts as an OAuth 2.0 Resource Server, to resolve and validate access_tokens, and inject them into the context:
For information about allowing third-party applications to access users' resources without having users' credentials, see OAuth 2.0 Authorization Framework.
For information about the context, see "OAuth2Context". For examples that use fields in OAuth2Context to throttle access to the sample application, see "Configuring Mapped Throttling" and "Configuring Scriptable Throttling".