I have a requirement to access an external web service from pega 7.3.1 using OAuth 2.0 with the client credentials flow. Anyone have any experience of this would like to share best practice?
I can see that later versions of pega allow more configuration when creating an authentication profile ie the connection to the token provider
@matthewk2081 ok so I have made some progress on this - the last challenge - hopefully is configuring the O Auth 2.0 Authentication profile. I was hoping to be able to populate the secret value using Global Resources Settings but it appears that field doesnt support that syntax Pegasystems Documentation.
What is an alternative way if hard coding the value is not an option?
@matthewk2081 I am researching how to dynamically pass in the client secret, as we don’t want devs to maintain/access the key. Have you found a way to use GRS or other dynamic approach?
@robs1550 Nope, I raised an SR with Pega and am yet to receive a response
Hello @matthewk2081. I checked to try to find the SR you reference. Is it the one you logged on 28 February?
SR-113418/ INC-213581 (security issue in O Auth 2.0 authentication profile)
I have checked the investigation that was carried out:
On March 7th the support engineer informed you that this is an enhancement request
FDBK-86037 was created on your behalf, and this information was passed back to you, which you acknowledged.
Details of the enhancement request for our engineering team to consider for a future version:
“Request is for the client secret field for an OAuth 2.0 Authentication profile to support Global Resources settings (ref: Pegasystems Documentation) or a suitable workaround. Currently the client secret would have to be hard coded which from a security standpoint is unacceptable is preventing us from using this functionality.”
Therefore I believe we have answered your question. Feel free to follow up the FDBK with your Pega AE if required.
I have linked it to this forum question for visibility.
Looks like this is not present in Pega v8.8, when this will be taking care?
@DebashisHere please follow up with your AE about any existing Enhancement Requests.
