Partition OAuth Clients

PlatformManager can call a partition with its own OAuth credential instead of the credentials of an entitled user. You register that credential in the OAuth Clients tab of the Partition Access Entitlement dialog.

Navigation: Account > Partitions > {partition} three-dot menu > Partition Access Entitlement > OAuth Clients

Registering an OAuth client requires the Partition – Edit permission.

Prerequisites

• The partition runs a release that supports OAuth authorization.

• An OAuth client with the Client ID platform-manager is registered on the partition, as the oauthConfiguration entry in Advanced Configuration Options on the partition (Administration > Configuration > Advanced Configuration Options).

• That client’s redirect URI is the PlatformManager callback address, {your PlatformManager host}/oauth-callback/index.html. The partition matches the redirect URI as an exact string.

• You can log in to the partition as a user whose rights cover what PlatformManager does on that partition. For the user roles each feature needs, see Required Partition User Roles.

For the partition-side configuration, see OAuth Authorization in the Configuration Knowledge Base.

Register the Client

1. Open Partition Access Entitlement from the partition row menu and select the OAuth Clients tab.

2. On the PlatformManager card, click PlatformManager OAuth Client.

3. Click Log in & authorize. PlatformManager opens the partition login page in a popup window.

4. Log in on the partition and grant access. To cancel, close the popup.

5. The dialog returns to the card list and the card shows the status Registered.

PlatformManager stores the credential it receives. The card then shows the Client ID, the date under Added, and Client Secret as Stored securely — never displayed.

PlatformManager then checks the user roles of the user who authorized the client. The dialog shows the result. For the possible results, see Required Partition User Roles.

Statuses

Actions on a Registered Client

• Test – Calls the partition with the stored credential. On success the message names the user the credential acts as. If the partition rejects the credential, the card switches to Invalid. The test also checks the user roles of that user.

• Re-authorize – Repeats the login and replaces the stored credential. Use it after the credential becomes invalid, or to switch to another partition user.

• Delete – Removes the stored credential from PlatformManager. PlatformManager then falls back to user and password authentication with the entitled user account. The OAuth client itself stays registered on the partition until you delete it there.