Manage OAuth API Clients

OAuth clients offer fine-grained permissions, require client authentication before issuing access tokens, and allow configurable token validity, offering enhanced security and control over API access. For information about OAuth2-based RSA API permissions, see OAuth 2.0-Based Permissions for the Cloud Administration APIs.

In contrast, API keys offer basic access but lack granular permissions, authorization for incoming requests, and have long lifespans, which can pose security risks. If you have configured your clients using legacy API keys, RSA recommends transitioning to OAuth API clients for secure access and better control.

Add API Client

This section provides instructions for adding an API client to the Cloud Administration Console. Adding an API client allows you to configure and manage access to the Cloud Administration and Authentication APIs, providing detailed control over API permissions and security.

Procedure 

1. In the Cloud Administration Console, click Platform> API Access Management.

2. In the OAuth Clients section, click Add API Client.

3. On the Basic Information tab, complete these fields.

   1. In the Name field, enter a name for the OAuth client application that will register with the authorization server (for example, Splunk OAuth Demo Client).

   2. (Optional) In the Description field, enter a description for the OAuth client.

   3. From the Client Type drop-down list, select the appropriate client type:

      • Admin API - Grants access to Cloud Access Service (CAS) administration API scopes.

      • RSA Agent API - Enables certificate provisioning for passwordless authentication in MFA Agents.

      • MFA API (Authentication API) - Provides access to multi-factor authentication APIs.

      • SCIM API  - Provid access to SCIM using OAuth-based authentication.

4. Click Next Step.

5. On the Authentication tab, complete these fields.

   1. The Issuer URL is read-only and displays the URL endpoint that identifies the authorization server issuing the tokens.

   2. The Client ID field is auto-populated. Make sure to note it down for later use in the client application.

   3. The Grant Type is a read-only field that is set to 'Client Credentials' type.

   4. The Client Authentication is a read-only field that displays the method required for client authentication. It is set to 'Private Key JWT'.

   5. In the Public Key field, enter the public key corresponding to the private key used by the client to sign the JWT.

      Alternatively, click Generate Key to create a new key. In the Key Pair Generator dialog box, specify the key type, click Generate Key Pair and then click Autofill. Make sure to download or copy the private key to a secure location, as it will be needed later by the client to sign the JWT.

      Note:  Be sure to note the Issuer URL, Client ID, and Private Key (if generated via the Cloud Administration Console), as you will need them when accessing the Cloud Administration or Authentication API from your client application.

   6. In the Access Token Lifetime field, enter the duration of the access token’s validity. The default duration is 5 minutes, with a maximum validity of 24 hours.

   7. (Optional) Select the Encrypt Access Token checkbox to encrypt the access token, ensuring that it can only be decrypted by RSA and hiding its payload from unauthorized access. This also enhances security using JSON Web Encryption (JWE).

   8. In the Network Zone drop-down list, select a network zone. Network zones are used to classify IP addresses as Trusted or Restricted, allowing you to manage and identify traffic coming into the application. For information about network zones, see Manage Networks

6. On the Permissions tab, select the checkboxes for the permissions categorized into groups.

   Note:  Available permissions will vary depending on the client type you selected.

   1. For Cloud Administration APIs, select from the following groups, depending on which Administration APIs will be used by the client: Agent, Audit, Authenticator, Report, User, and Local Group.

   2. For Cloud Authentication APIs, select the MFA group.

      Selecting a permission checkbox includes it in the request, along with any other selected permissions. For more information, see OAuth 2.0-Based Permissions for the Cloud Administration APIs.
      

   Note:  Default permissions are automatically included in the access token if the scope parameter is empty or not explicitly requested. Non-default scopes are included only when specifically requested.

7. Click Save and Finish.

8. (Optional) To publish this configuration, click Publish Changes.

Use the Sample Code to generate the access token for the Cloud Administration APIs. For more information, see Cloud Administration APIs - Sample Code.