OAuth2ResourceServerFilter

enabled: configuration expression<boolean>, optional

Enable or disable caching.

Default: false

defaultTimeout: configuration expression<duration>, optional

The duration for which to cache an OAuth 2.0 access_token if it doesn't provide a valid expiry value.

If an access_token provides an expiry value that falls before the current time plus the maxTimeout, IG uses the token expiry value.

The following example caches access_tokens for these times:

• One hour, if the access_token doesn't provide a valid expiry value.

• The duration specified by the token expiry value, when the token expiry value is shorter than one day.

• One day, when the token expiry value is longer than one day.

"cache": {
  "enabled": true,
  "defaultTimeout": "1 hour",
  "maxTimeout": "1 day"
}

Default: 1 minute

maxTimeout: configuration expression<duration>, optional

The maximum duration for which to cache OAuth 2.0 access_tokens.

If an access_token provides an expiry value that falls after the current time plus the maxTimeout, IG uses the maxTimeout.

The duration cannot be zero or unlimited.

For information about supported formats for duration, see duration.

"amService": AmService reference, required

(From AM 6.5.3.) The AmService to use for the WebSocket notification service. To evict revoked access_tokens from the cache, enable the notifications property of AmService.

See also, "AmService".

onNotificationDisconnection: configuration expression<enumeration>, optional

The strategy to manage the cache when the WebSocket notification service is disconnected, and IG receives no notifications for AM events. If the cache is not cleared it can become outdated, and IG can allow requests on revoked sessions or tokens.

Cached entries that expire naturally while the notification service is disconnected are removed from the cache.

Use one of the following values:

• NEVER_CLEAR

  • When the notification service is disconnected:

    • Continue to use the existing cache.

    • Deny access for requests that are not cached, but do not update the cache with these requests.

  • When the notification service is reconnected:

    • Continue to use the existing cache.

    • Query AM for incoming requests that are not found in the cache, and update the cache with these requests.

• CLEAR_ON_DISCONNECT

  • When the notification service is disconnected:

    • Clear the cache.

    • Deny access to all requests, but do not update the cache with these requests.

  • When the notification service is reconnected:

    • Query AM for all requests that are not found in the cache. (Because the cache was cleared, the cache is empty after reconnection.)

    • Update the cache with these requests.

• CLEAR_ON_RECONNECT

  • When the notification service is disconnected:

    • Continue to use the existing cache.

    • Deny access for requests that are not cached, but do not update the cache with these requests.

  • When the notification service is reconnected:

    • Query AM for all requests that are not found in the cache. (Because the cache was cleared, the cache is empty after reconnection.)

    • Update the cache with these requests.

Default: CLEAR_ON_DISCONNECT

A list of one of more scopes that the OAuth 2.0 access_token must have.

array of runtime expression<string>, required if ScriptableResourceAccess is not used

A string, array of strings, runtime expression<string>, or array of runtime expression<string> to represent one or more scopes; mutually exclusive with ScriptableResourceAccess.

ScriptableResourceAccess, required if "array of runtime expression<string>" is not used

A script that produces a list of one or more required scopes; mutually exclusive with "array of runtime expression<string>".

The script evaluates each request dynamically and returns the scopes that request needs to access the protected resource. The script must return a Promise<Set, ResponseException> or a Set<String>.

For information about the properties of ScriptableResourceAccess, see Scripts. For an example of how to use this property, see the examples section on this page.

{
  "name": ScriptableResourceAccess-1,
  "type": "ScriptableResourceAccess",
  "config": {
    "type": string,
    "file": expression,                     // Use either "file"
    "source": string or array of strings,   // or "source", but not both.
    "args": object,
    "clientHandler": Handler reference
  }
}