Question

A while back, I registered an application as an OAuth client using the steps described here: http://www-10.lotus.com/ldd/appdevwiki.nsf/dx/Getting_Started_with_IBM_Connections_API_via_OAuth. When using the application to run through the OAuth procedure to get the refresh token and access token, everything works out and a new refresh token and access token are granted. When going to the Application Access page after the whole OAuth process, the application does not show up within the user's Application Access page. Even now, after a few days of not going through the OAuth process, the refresh token can still be used to get a new access token and this in turn can be used to access the user's data. What I want to know is why would this occur? Did I miss some steps in the whole process or am I just not understanding the functionality of the Application Access page?

Was it helpful?

Solution

You will want to read up on the various oAuth settings that are possible with IBM Connections. http://www-01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/admin/admin/t_inst_installingandenablingoauthtai.dita

In particular you'll want to look at

oauth20.issue.refresh.token true If set to true, clients will receive a refresh token. If set to false, clients must request authorization when the access token expires.

it means you should check your WebSphere Console and check the Trusted Authentication Interceptor settings and see if that is set to True or False.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top