Introduction

By default, when connecting to IFS Cloud from Boomi, you should use OAuth 2.0 authentication.  Although it may be possible to configure IFS Cloud to support basic authentication, this is not initially supported and currently enabling this option is not possible for IFS Cloud instances hosted by IFS.

This article discusses how to configure IFS Cloud and Boomi to support OAuth 2.0 authentication

IAM Client within IFS Cloud

The IAM Client within IFS Cloud defines the client id, client secret and, optionally, the redirect_uri which you'll use within the Boomi connection to IFS.  You can either create your own client within IAM Clients in IFS Cloud, or for IFS Cloud 21R1 Service Update 4 or later, you can use the predefined client IFS_boomi.

IFS_boomi IAM Client & Refresh Token expiry

To address token expiration issues, IFS has introduced a special IAM client, IFS_boomi, which allows refresh tokens with an extended 30-day expiry. The expiration is tied to session idle time, which defines how long a session can remain idle before expiring.

Session Idle Time:

• Until IFS Application version 24R1: 2 hours

• From IFS Application version 24R2: 30 minutes

By default, all other IAM clients—both predefined and user-created—have a refresh token expiry matching the session idle time (2 hours before 24R2, reduced to 30 minutes after 24R2). This means that, you must manually regenerate the token at each session expiration, within the Boomi connection page.

To enable the 30-day refresh token for IFS_boomi, the OAuth 2.0 Connection Scope must be set to openid offline_access. This applies only to the "Authentication Code" and "Resource Owner Credentials" grant types.

Note : The use of the offline_access scope with the  Client Credentials grant type is restricted and will be deprecated in the near future. This change has being introduced because the Client Credentials flow does not retain tokens for reuse.

Other IAM Clients & Refresh Token expiry

As mentioned above , if you use an IAM client other than IFS_boomi with its scope of openid offline_access, the refresh token will expire after the Session Idle time and must be manually regenerated.There is an exception to this in that the refresh token is updated automatically by the basic runtime and cached each time the connection is used.  So, if you have, or create, a deployed process with a schedule more frequent than the token expiry time, the basic runtime will refresh and cache a new token, thereby overcoming the token expiry.  This cached token would be shared by all processes using that same connection on that same basic runtime.

If the token has expired, you will see the following error message in the logs

Failed updating OAuth Token: Internal Server Error (500) Server Error

  

Client ID and Client Secret

You need to note the Client ID, normally IFS_boomi, and the associated Client Secret as these are used with all of the Grant Types.

IAM Client and redirect_uri with "Authentication Code" Grant Type

The OAuth 2.0 IDP needs to "callback" to Boomi with the token information for authentication during the authentication process when the "Authentication Code" grant type is used.  This callback location is specified in the redirect_uri.  You can either specify the redirect_uri within the IAM Client setup, or you can specify it as part of the Connection information within Boomi.

If you intend to specify the redirect_uri within the IAM Client, the format of the uri is

https://platform.boomi.com/account/<your boomi account id>/oauth2/callback

You can discover your boomi account within Boomi under Settings/Account/Account Information/Account ID



Using the above example, the complete redirect_uri would be

https://platform.boomi.com/account/Boomi_AccountID/oauth2/callback

If you wish to specify the redirect_uri within the Boomi Connection, you should still add a redirect_uri to the IAM Client to allow this connection as follows

https://platform.boomi.com/*

 

OAuth 2.0 Connection

To create an OAuth 2 connection, firstly create a new Connection and specify the authentication type as OAuth 2.0

Supported Grant Types

The connector support 3 "Grant Types" to retrieve a token from the IFS Cloud server, which is then used for authentication.  These are "Client Credentials", "Resource Owner Credentials" and "Authorization Code".

Grant Type	Description
Client Credentials	Uses the credentials from the IAM Client (i.e. Client ID and Client Secret) for authentication.  The Service Account User specified within the IAM Client (e.g ifsboomi) is then used to define privileges and access within IFS.
Resource Owner Credentials	Uses the IAM Client credentials, and a user input user account and password to identify the account which should be used for privileges within IFS.  The user account information is stored within Boomi.
Authorization Code	This is similar to Resource Owner Credentials, but rather than storing the IFS username and password within Boomi, during token generation, the Aurena client login process is used to authenticate the user, with this process using the redirect_uri to call back to Boomi to complete the token retrieval.  Since the user information is not stored within Boomi, this may be viewed as more secure than Resource Owner Credentials.

The selection of Grant Type is user dependent and all are valid options.  If you wish to use a Service Account User to define access within your IFS environment, and you don't wish the integration user to have UI login rights, then Client Credentials may be the right type.  If you wish to use a user login, then Resource Owner and Authorization Code might be used.

Specify OAuth 2.0 Details

Access OpenID Connect Discovery
Following documentation explains OAuth2 and Open ID Connect related metadata in a format specified by the OpenID Connect Discovery specification. Follow the navigation below to find the Access Token URL and Authorization Token URL. 

1. In IFS Cloud, navigate to Solution Manager > Integration > API Explorer.

2. Select any API in the list.

3. From the Documentation dropdown that appears above the list, click API Doc.

4. Expand the AUTHORIZATIONS section and click on the Connect URL.

Select the OAuth 2.0 tab to complete the configuration.  Firstly, select the desired Grant Type.

Client Credentials

 

Item	Description
Client ID	Discovered from IAM Client above
Client Secret	Discovered from IAM Client above
Scope	openid
Access Token URL	https://<path_to_idp>/token

You can discover the path to the IDP from the IFS Cloud login page



The url upto openid-connect is the path to the idp.  So, in the above example, the AccessToken URL will be

https://server.ifs.com/auth/realms/realm/protocol/openid-connect/token

 

Once you've specified your credentials etc., you can use Test Connection to test the connection to IFS.

Resource Owner Credentials

Item	Description
Client ID	Discovered from IAM Client above
Client Secret	Discovered from IAM Client above
Scope	openid
Access Token URL	https://<path_to_idp>/token

You can discover the path to the IDP from the IFS Cloud login page



The url upto openid-connect is the path to the idp.  So, in the above example, the AccessToken URL will be

https://server.ifs.com/auth/realms/realm/protocol/openid-connect/token

 

When selecting Generate, you'll additionally be prompted to enter the resource owner credentials - i.e. a username and password for an IFS user.



Once you've generated and retrieved the token, this is then used to authenticate Boomi against IFS.  If your token expires, you can retrieve a new token by later selecting ReGenerate.

Authorization Code

Item	Description
Client ID	Discovered from IAM Client above
Client Secret	Discovered from IAM Client above
Authorization Token URL	https://<path_to_idp>/auth
Scope	openid or openid offline_access
Access Token URL	https://<path_to_idp>/token

You can discover the path to the IDP from the IFS Cloud login page



The url upto openid-connect is the path to the idp.  So, in the above example, the Authorization Token URL will be

https://server.ifs.com/auth/realms/realm/protocol/openid-connect/auth

and the Access Token URL will be

https://server.ifs.com/auth/realms/realm/protocol/openid-connect/token

If you're specifying your redirect_uri in the connection and have specified https://platform.boomi.com/* as the redirect_uri in the Client ID, you should add an Authorization Parameter and Token Parameter

Name	Value
redirect_uri	https://platform.boomi.com/account/Boomi_AccountID/oauth2/callback

 

Once you've configured these settings, you can then select Generate to retrieve the token from IFS.  If you're not already logged into IFS, you will be prompted to login to IFS during this process.

Once you've generated and retrieved the token, this is then used to authenticate Boomi against IFS.  If your token expires, you can retrieve a new token by later selecting ReGenerate.