Access Control Demo Guide

This is demo guide to configure F5 Access Policy Manager as…

• OAuth Authorization Server,

• OAuth Resource Server

• Token converter from opaque to JWT

Also to demonstrate user object checking to prevent Broken Object Level Authorization (BOLA) attack

Contents

• Topology
  • Call flow
• Configure Opaque Access Token Provider
  • Creating OAuth Scope
  • Add OAuth Client
  • Add Oauth Resource Server (RS)
  • Create OAuth Profile
  • Create Local Identity Provider (IdP)
  • Add User Credentials
  • Create Access Policy
  • Create Access Policy Flow
  • Create Virtual Server
  • Testing Opaque Access Token Request
• Configure Access Using Opaque Token
  • Create OAuth Provider
  • Create OAuth Resource Server Profile
  • Create Access Profile for Resource Server
  • Create Per-Request Policy Profile for Resource Server
  • Attach Access & Per-Request Policy Profile
  • Test The Configuration
• Implement Phantom Token (Token Conversion) Model
  • Create JWT Claim
  • Create JWT Key
  • Create OAuth Bearer Profile
  • Add SSO In Access Profile
  • Test The Configuration
• Broken Object Level Authorization (BOLA) Protection
  • Create User Name Session Variable On Session Creation
  • Add User Check Logic In Policy
  • Testing The Configuration
• Limiting User Access Session
  • Create Access Policy
  • Add Access Authentication
  • Testing