OAuth Client Roles

OAuth clients on the API Access page identify third-party applications that call Riverbed IQ Ops APIs programmatically. OAuth client roles extend Role-Based Access Control (RBACClosed Role-Based Access Control) to those integrations. An administrator assigns built-in roles directly to each OAuth client. When an application uses that client's credentials to obtain an access token, API authorization follows the roles on the client, not the roles of the administrator who created it.

OAuth client roles use the same built-in role definitions as user accounts. The product evaluates every role assigned to an OAuth client together, the same way it evaluates multiple roles on a user account. For role names, descriptions, and capability tables, see Riverbed Console Built-in Roles. For how RBAC works across the product, see Role-Based Access Control.

Default access for OAuth clients

OAuth clients continue to support API write access by default. That default behavior is unchanged for integrations that do not use OAuth client roles.

When you assign OAuth client roles, those assignments shape what the access token can do when the integration calls the API. Assign only the roles the application needs.

Note: If you do not assign OAuth client roles to a client, the product applies a default role to that client. The default role name and scope are not yet finalized in this release.

Roles available for OAuth clients

The role picker on the API Access page lists a subset of built-in roles intended for management and service integrations. It does not list every role available when you invite a user on the User Management page.

Note: The exact list of assignable OAuth client roles is still being finalized. Until that list is published in Riverbed Console Built-in Roles, use the roles shown in the API Access page role picker when you configure a client.
Note: You can assign multiple built-in roles to a single OAuth client. The product evaluates the full set of assigned roles together when the client obtains an access token.

Assign OAuth client roles when you create a client

When you register a new OAuth client, you can assign one or more roles before the client is used to obtain tokens.

Navigate to the API Access Page:

  1. Click the Launchpad button ⁝⁝⁝.
  2. Click IQ Ops > Management.
  3. In the Management page, click the Hamburger Icon, then click API Access Page.

To assign roles while you create an OAuth client:

  1. Click Create OAuth Client.

  2. On the Create OAuth Client dialog, type an OAuth Client Name and select a Secret Expiration interval.

  3. In Assigned Role(s), select every built-in role the integration needs. You can select more than one role.

  4. Click Create.

  5. On the OAuth Client Created dialog, copy the client ID and client secret to a secure location. After you close the dialog, the client secret is not shown again.

For the full list of API Access page controls, including client secret management, see API Access Page.

Change roles on an existing OAuth client

The API Access client list shows a Roles column with the roles currently assigned to each OAuth client. To add or remove roles on an existing client:

  1. Open the API Access page.

  2. In the client list, locate the OAuth client you want to change.

  3. Click the ... menu on that row, then click Assign Role(s).

  4. In the Edit Roles dialog, add or remove roles in Assigned Role(s), then click Submit.

Obtain an access token for an OAuth client

After you create an OAuth client and assign roles, the integrating application uses the client credentials grant to request an access token. The token carries the OAuth client roles assigned on the API Access page. Use that token when you call Riverbed IQ Ops APIs.

The top of the API Access page lists the values most integrations need for token requests:

  • Access Token URI: Endpoint where the application requests an access token.

  • API Scope: Scope value to include in the token request.

  • Base URI: Base URI for API calls after you obtain a token.

  • Tenant Id: Tenant identifier for the token request.

Each OAuth client also has a unique Client Id and one or more client secrets. Copy those values from the client list or from the OAuth Client Created dialog when you register the client.

To obtain and use an access token:

  1. From the API Access page, copy Access Token URI, API Scope, Base URI, and Tenant Id.

  2. Copy the OAuth client's Client Id and an active client secret.

  3. Send a client credentials token request to the Access Token URI using the client ID, client secret, and API scope. For request format, grant type values, and API endpoints, see the Riverbed IQ REST API portal.

  4. Include the access token in API requests to the Base URI. Authorization follows the OAuth client roles assigned to that client, together with the default API access for OAuth clients.

Related topics