3. Security and Validation

oauth2Resource2

Version

Allows only authorized HTTP requests to pass through. Unauthorized requests get a redirect to the authorization server as response. This interceptor does Session Management and can thereby translate Session IDs to OAuth2/OIDC Access Tokens. Beyond regular OIDC-compliant authorization servers, this interceptor can also be used with Azure B2C.

Syntax

oauth2Resource2:
'$ref': <string>
afterErrorUrl: <string>
afterLogoutUrl: <string>
appendAccessTokenToRequest: <boolean>
callbackPath: <string>
cookieOriginalExchangeStore: {}
customHeaderUserPropertyPrefix: <string>
github: {}
google: {}
inMemorySessionManager2: {}
jwtSessionManager: {}
loginParameters:
- <loginParameters>
logoutUrl: <string>
membrane: {}
memcachedOriginalExchangeStore: {}
memcachedSessionManager: {}
microsoftEntraID: {}
onlyRefreshToken: <boolean>
publicURL: <string>
redisOriginalExchangeStore: {}
redisSessionManager: {}
revalidateTokenAfter: <number>
sessionOriginalExchangeStore: {}
skipUserInfo: <boolean>
oauth2Resource2:
  '$ref': <string>
  afterErrorUrl: <string>
  afterLogoutUrl: <string>
  appendAccessTokenToRequest: <boolean>
  callbackPath: <string>
  cookieOriginalExchangeStore: {}
  customHeaderUserPropertyPrefix: <string>
  github: {}
  google: {}
  inMemorySessionManager2: {}
  jwtSessionManager: {}
  loginParameters:
    - <loginParameters>
  logoutUrl: <string>
  membrane: {}
  memcachedOriginalExchangeStore: {}
  memcachedSessionManager: {}
  microsoftEntraID: {}
  onlyRefreshToken: <boolean>
  publicURL: <string>
  redisOriginalExchangeStore: {}
  redisSessionManager: {}
  revalidateTokenAfter: <number>
  sessionOriginalExchangeStore: {}
  skipUserInfo: <boolean>

Attributes

NameRequiredDefaultDescriptionExamples
$reffalse-Reference a component defined under components.-
afterErrorUrlfalse---
afterLogoutUrlfalse---
appendAccessTokenToRequestfalse---
callbackPathfalseoauth2callbackthe path used for the OAuth2 callback. ensure that it does not collide with any path used by the application-
customHeaderUserPropertyPrefixfalsenullA user property prefix (e.g. "header"), which can be used to make the interceptor emit custom per-user headers. For example, if you have a user property "headerX: Y" on a user U, and the user U logs in, all requests belonging to this user will have an additional HTTP header "X: Y". If null, this feature is disabled.-
logoutUrlfalse-Path (as seen by the user agent) to call to trigger a log out. If the Authorization Server supports OpenID Connect RP-Initiated Logout 1.0, the user logout ("single log out") will be triggered there as well.-
onlyRefreshTokenfalse---
revalidateTokenAfterfalse-1time in seconds until a oauth2 access token is revalidatet with authorization server. This is disabled for values < 0-
skipUserInfofalse---

Child Structure

ElementCardinalityDescription
cookieOriginalExchangeStore0..1
github0..1
google0..1
inMemorySessionManager20..1
jwtSessionManager0..1
membrane0..1
memcachedOriginalExchangeStore0..1
memcachedSessionManager0..1
microsoftEntraID0..1
publicURL0..1
redisOriginalExchangeStore0..1Used for storing exchanges temporarily in Redis. Supports authentication with or without password and username
redisSessionManager0..1
sessionOriginalExchangeStore0..1

Can be used in