Description
This article describes how to configure Oauth2.0 Based Client Authentication on FortiWeb.
Scope
FortiWeb 7.0 GA and above.
Solution
The OAuth 2.0 authorization framework is a protocol that allows authorizing a third-party web site or application access to the protected resources without necessarily revealing the long-term credentials or even the identity.
For example, when users access the application, it is possible to log in with a Google account.
FortiWeb supports OAuth 2.0 for front-end authentication, and it works as an authorization client or a resource server.
Configuration:
1) Go to User -> OAuth Server. Create a Google or Facebook OAuth server entry by Cloning a predefined item. In this example, google OAuth Server is used as the OAuth Server.
Set the relevant Client ID, Client Secret & Redirection Endpoint.
Note.
The Redirection Endpoint MUST match Published Site & Path in the Site Publish Rule (3)) otherwise, Site Publish cannot capture the request.
2) Go to Application Delivery -> Site Publish -> OAuth Server Pool and create an OAuth Server Pool. Make sure the ‘Oauth Server Name’ defined is matching with the ;sph_oauth_server' value in the OAuth Login Page.
3) Go to Application Delivery -> Site Publish and configure Site Publish.
4) Call the Site Publish Policy in the Web Protection Profile applied to the Server Policy.
After Configuration:
The client gets the Following Replacement page while accessing the Site Publish Protected website for the first time (Without presenting Auth Bearer token in the Request).
Upon Selecting the Oauth Provider, the Client will be redirected to the AS. In this example, it is Google Auth.
After successful authentication with the Google Auth, the Client will be redirected back to the Origin website with an Auth Code.
FortiWeb extracts the code and then requests for token followed by FWB requesting for the username to the Google Oauth Server.
Once this verification passes, Fortiweb will forward the requests to the Real Server. The username will be recorded in the Traffic log as visible below.
