import ballerina/http;
listener http:Listener securedEP = new(9090,
secureSocket = {
key: {
certFile: "../resource/path/to/public.crt",
keyFile: "../resource/path/to/private.key"
}
}
);
// The service can be secured with OAuth2 authentication and can be authorized
// optionally. OAuth2 authentication can be enabled by setting the
// [`http:OAuth2IntrospectionConfig`](https://docs.central.ballerina.io/ballerina/http/latest/records/OAuth2IntrospectionConfig) configurations.
// Authorization is based on scopes. A scope maps to one or more groups.
// Authorization can be enabled by setting the `string|string[]` type
// configurations for `scopes` field.
@http:ServiceConfig {
auth: [
{
oauth2IntrospectionConfig: {
url: "https://localhost:9445/oauth2/introspect",
tokenTypeHint: "access_token",
scopeKey: "scp",
clientConfig: {
customHeaders: {"Authorization": "Basic YWRtaW46YWRtaW4="},
secureSocket: {
cert: "../resource/path/to/public.crt"
}
}
},
scopes: ["admin"]
}
]
}
service /foo on securedEP {
// It is optional to override the authentication and authorization
// configurations at the resource levels. Otherwise, the service auth
// configurations will be applied automatically to the resources as well.
resource function get bar() returns string {
return "Hello, World!";
}
}
Service - OAuth2An HTTP service/resource can be secured using OAuth2 and by enforcing
authorization optionally. Then, it validates the OAuth2 token sent in the
|
import ballerina/http;
listener http:Listener securedEP = new(9090,
secureSocket = {
key: {
certFile: "../resource/path/to/public.crt",
keyFile: "../resource/path/to/private.key"
}
}
);
@http:ServiceConfig {
auth: [
{
oauth2IntrospectionConfig: {
url: "https://localhost:9445/oauth2/introspect",
tokenTypeHint: "access_token",
scopeKey: "scp",
clientConfig: {
customHeaders: {"Authorization": "Basic YWRtaW46YWRtaW4="},
secureSocket: {
cert: "../resource/path/to/public.crt"
}
}
},
scopes: ["admin"]
}
]
}
service /foo on securedEP {
The service can be secured with OAuth2 authentication and can be authorized
optionally. OAuth2 authentication can be enabled by setting the
http:OAuth2IntrospectionConfig
configurations.
Authorization is based on scopes. A scope maps to one or more groups.
Authorization can be enabled by setting the string|string[]
type
configurations for scopes
field.
resource function get bar() returns string {
return "Hello, World!";
}
}
It is optional to override the authentication and authorization configurations at the resource levels. Otherwise, the service auth configurations will be applied automatically to the resources as well.
# You may need to change the certificate file path and private key file path.
bal run http_service_oauth2.bal