3. Security and Validation

oauth2Resource2

Version

Allows only authorized HTTP requests to pass through. Unauthorized requests get a redirect to the authorization server as response. This interceptor does Session Management and can thereby translate Session IDs to OAuth2/OIDC Access Tokens. Beyond regular OIDC-compliant authorization servers, this interceptor can also be used with Azure B2C.

Syntax

oauth2Resource2:
'$ref': <string>
afterErrorUrl: <string>
afterLogoutUrl: <string>
appendAccessTokenToRequest: <boolean>
callbackPath: <string>
cookieOriginalExchangeStore: {}
customHeaderUserPropertyPrefix: <string>
github: {}
google: {}
inMemorySessionManager2: {}
jwtSessionManager: {}
loginParameters:
- <loginParameter>
logoutUrl: <string>
membrane: {}
memcachedOriginalExchangeStore: {}
memcachedSessionManager: {}
microsoftEntraID: {}
onlyRefreshToken: <boolean>
publicURL: <string>
redisOriginalExchangeStore: {}
redisSessionManager: {}
revalidateTokenAfter: <number>
sessionOriginalExchangeStore: {}
skipUserInfo: <boolean>
oauth2Resource2:
  '$ref': <string>
  afterErrorUrl: <string>
  afterLogoutUrl: <string>
  appendAccessTokenToRequest: <boolean>
  callbackPath: <string>
  cookieOriginalExchangeStore: {}
  customHeaderUserPropertyPrefix: <string>
  github: {}
  google: {}
  inMemorySessionManager2: {}
  jwtSessionManager: {}
  loginParameters:
    - <loginParameter>
  logoutUrl: <string>
  membrane: {}
  memcachedOriginalExchangeStore: {}
  memcachedSessionManager: {}
  microsoftEntraID: {}
  onlyRefreshToken: <boolean>
  publicURL: <string>
  redisOriginalExchangeStore: {}
  redisSessionManager: {}
  revalidateTokenAfter: <number>
  sessionOriginalExchangeStore: {}
  skipUserInfo: <boolean>

Attributes

NameRequiredDefaultDescriptionExamples
$reffalse-Reference a component defined under components.-
afterErrorUrlfalse---
afterLogoutUrlfalse---
appendAccessTokenToRequestfalse---
callbackPathfalseoauth2callbackthe path used for the OAuth2 callback. ensure that it does not collide with any path used by the application-
customHeaderUserPropertyPrefixfalsenullA user property prefix (e.g. "header"), which can be used to make the interceptor emit custom per-user headers. For example, if you have a user property "headerX: Y" on a user U, and the user U logs in, all requests belonging to this user will have an additional HTTP header "X: Y". If null, this feature is disabled.-
logoutUrlfalse-Path (as seen by the user agent) to call to trigger a log out. If the Authorization Server supports OpenID Connect RP-Initiated Logout 1.0, the user logout ("single log out") will be triggered there as well.-
onlyRefreshTokenfalse---
revalidateTokenAfterfalse-1time in seconds until a oauth2 access token is revalidatet with authorization server. This is disabled for values < 0-
skipUserInfofalse---

Child Structure

ElementCardinalityDescription
cookieOriginalExchangeStore0..1
github0..1
google0..1
inMemorySessionManager20..1
jwtSessionManager0..1
loginParameter0..*
membrane0..1
memcachedOriginalExchangeStore0..1
memcachedSessionManager0..1
microsoftEntraID0..1
publicURL0..1
redisOriginalExchangeStore0..1Used for storing exchanges temporarily in Redis. Supports authentication with or without password and username
redisSessionManager0..1
sessionOriginalExchangeStore0..1

Can be used in