Access Management 2.0

Objective

Manhattan Active® Platform Access Management 2.0 has an administrative user interface to configure or modify several security aspects, such as the authentication and OAuth client setup. This document describes how you can set up OAuth 2.0 clients for external integration and for calling the REST API.

Before You Begin

You will need access to the Manhattan Active® Platform application and a Maactive System Administrator role to configure security properties in the Access Management 2.0 administration user interface.

To access the administration UI, go to your Access Management 2.0 URL (https://<unique_id>-auth.<domain_name>/auth/admin/maactive/console/). After you log in, administration UI will look something like this:

The panel is accessible only to the users with the Maactive System Administrator role.

Managing OpenID Connect clients
Clients are entities that request authentication on behalf of a user. Clients come in two forms. The first type of client is an application that wants to participate in a Single Sign On. These clients are only looking for security from Access Management 2.0. The other type of client is one that requests an access token so that it can invoke other services on behalf of the authenticated user.

Steps

Let’s see how you can create a new OpenID Connect client.

1. Under the Manage menu, click on Clients.

   

2. Click on Create client.

3. Under General Settings, leave the Client type set to OpenID Connect

   

4. Enter a Client ID
   This is an alphanumeric string that specifies ID reference in URI and tokens.

5. Enter a Name for this client.
   Specify the display name of this client.

6. You can optionally give a description of this client in the Description field.

7. Click on Save. This action will create a client for you.

8. Next, under Capability config, we have a toggle button to enable/disable Client authentication. This setting depends on the type of OIDC you would like to create.
     Select ON if - the server-side clients perform browser logins and require client secrets when requesting for Access Token.
     Select OFF if - the client-side clients perform browser logins where secrets cannot be kept safe.

   

9. Enable/Disable the Authorization button for fine-grained authorization for clients.

10. Select Authentication flow as needed. Default ones are already enabled.

11. Click on Next.

12. Enter the Valid redirect URIs as needed.
    This is the place where the browser redirects after a successful login.

    

13. You will be redirected to the basic client configuration page. You can review or modify any other details needed on this page.

    

14. In case the Client Authentication was set to true in step 8, you will see a Credentials tab. Click on it. Make note of the Client Secret to be used during the authentication of this created client against Access Management 2.0.

    

Learn More

• Concept Guides
• Quick Starts

Author

• Shipra Choudhary: Senior Software Engineer, Security, Manhattan Active® Platform, R&D.