[oauth-eas] # The maximum number of OAuth 2.0 bearer token authorization decisions to cache. # This EAS has a built in cache for storing authorization decisions so that # repeated use of the same OAuth 2.0 bearer token does not require repeated # requests to TFIM. Bearer token decisions can be cached because they do not # require signing of the request, unlike OAuth 1.0 requests. The lifetime of the # cache entry is based on the Expires attribute returned by TFIM. If this # attribute is not returned, the decision will not be cached. # # This EAS implements a Least Recently Used cache, meaning the decision # associated with the least recently used bearer token will be forgotten when a # new bearer token decision is cached. A cache-size of 0 will disable caching of # authorization decisions cache-size = 0 # The Provider ID of the default OAuth federation at TFIM. If a Provider ID # is not provided in the request using the fed-id-param option, this provider # ID will be used for OAuth requests. The Provider ID of a federation can be # found on the federation properties page. default-fed-id = https://localhost/sps/oauthfed/oauth10 # The name of the request parameter that can be used to override the # default-fed-id option configured above. By deleting this configuration # option, you can enforce that the default fed id is always used. fed-id-param = FederationId # The default OAuth mode that this EAS will operate under. It affects the # validation of request parameters, as well as the construction of the RST # sent to TFIM. The default mode can be overriden for an individual request # by providing a valid mode value [OAuth10|OAuth20Bearer] in a request # parameter with the name specified in the mode-param option below. default-mode = OAuth10 # The name of the request parameter that can be used to override the # default-mode option configured above. By deleting this configuration # option, you can enforce that the default mode is always used. mode-param = mode # The name of the OAuth realm which will be used in a 401 request # for OAuth data. realm-name = # The name of the file which contains the body used when constructing a # '400 Bad Request' response. This response will be generated when # required OAuth elements are missing from a request. bad-request-rsp-file = # The name of the file which contains the body used when constructing a # '401 Unauthorized' response. This response will be generated when: # - all OAuth data is missing from a request, or # - the OAuth data fails validation. unauthorized-rsp-file = # The name of the file which contains the body used when constructing a # '502 Bad Gateway' response. This response will be generated when # TFIM fails to process the request. bad-gateway-rsp-file = # The name of the TAM trace component which is used by the EAS. trace-component = pdweb.oauth # The name of the TFIM cluster which houses this OAuth service. There should # also be a corresponding [tfim-cluster:] stanza which contains the # definition of the cluster. cluster-name = oauth-cluster # Should the native TAM ACL policy still take affect, in addition to the # OAuth authorization? apply-tam-native-policy = false [tfim-cluster:oauth-cluster] # # This stanza contains definitions for a particular cluster of TFIM # servers. # # # A specification for the server which is used when communicating with a # single TFIM server which is a member of this cluster. Values for this # entry are defined as follows: # # {[0-9],} # # Where the first digit (if present) represents the priority of the server # within the cluster (9 being the highest, 0 being lowest). If the priority # is not specified, a priority of 9 is assumed. The can be any # well-formed HTTP or HTTPS URL. # # Multiple server entries can be specified for failover and load balancing # purposes. The complete set of these server entries defines the # membership of the cluster for failover and load balancing. # # server = 9,http://tfim.example.com/TrustServerWST13/services/RequestSecurityToken # # The maximum number of cached handles, used when communicating with TFIM. # handle-pool-size = 10 # # The length of time, in seconds, before an idle handle will be removed # from the handle pool cache. # handle-idle-timeout = 240 # # The length of time, in seconds, to wait for a response from TFIM. # timeout = 240 # # The following configuration entries are optional and can be used if the TFIM # server has been configured to require basic authentication. If these # entries are left blank no basic authentication header will be provided when # communicating with the TFIM server. # # # The name of the user for the basic authentication header. # basic-auth-user = # # The password to be used for the basic authentication header. # basic-auth-passwd = # # The following SSL entries are optional and are only required if: # 1. At least one server entry indicates that SSL is to be used (i.e. # starts with https:) # 2. A certificate is required other than that which is used by this server # when communicating with the policy server (details of the # default certificate can be found in the [ssl] stanza of this # configuration file. # # If these entries are required and are not found within this stanza, the # default [ssl] stanza will be searched. # # # The name of the key database file which houses the client certificate to be # used. # # ssl-keyfile = # # The name of the password stash file for the key database file. # # ssl-keyfile-stash = # # The label of the client certificate within the key database. # # ssl-keyfile-label = # # This configuration entry specifies the DN of the server (obtained from the # server SSL certificate) which will be accepted. If no entry is configured # all DN's will be considered to be valid. Multiple DN's can be specified by # including multiple configuration entries of this name. # # ssl-valid-server-dn = # # The entry controls whether FIPS communication is enabled with TFIM or # not. If no configuration entry is present the global FIPS setting (as # determined by the TAM policy server) will take effect. # # ssl-fips-enabled =