Page History

{span:style=font-size:2em;font-weight:bold} JAX-RS: OAuth2 Assertions {span}


{toc}

h1. Introduction

[OAuth 2.0|http://tools.ietf.org/html/draft-ietf-oauth-v2] supports different types of access token grants. [OAuth2 Assertions|http://tools.ietf.org/html/draft-ietf-oauth-assertions-10] draft "provides a framework for the use of assertions
with OAuth 2.0" and [SAML2 Bearer Assertion Profiles for OAuth2|http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-15] draft specifically provides for the use of SAML2 Bearer assertions.

These assertions can be used as token grants, but also, if needed, for getting 3rd party clients authenticated. Note the clients can use assertions as grants but use for example Basic authentication mechanism, or use say an authorization code grant and the assertion to authenticate, and finally, they can use assertions as a grant and as an authentication token.

Currently CXF supports SAML2 Bearer assertions as grants and authentication tokens.

See also the [JAX-RS OAuth2] page for information about OAuth 2.0 support in CXF.

h1. SAML2 Bearer

h2. Access Token Grant

[This section|http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-15#section-2.1] explains how SAML2 Bearer assertions can be used as token grants. The value of grant_type parameter is "urn:ietf:params:oauth:grant-type:saml2-bearer".


It is really just another grant type, but whose actual value is a SAML assertion. The specification provides an [example|http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-15#section-4] of how such an assertion may look like.

The additional restriction is that the assertions have to be encoded using Base64Url encoding. 
Here is how a request may look like:

{code}
POST /token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&
assertion=Base64UrlEncoded-SAML2-Bearer-Assertion
{code}


h2. Authentication Token