VMware Cloud Partner Navigator uses OAuth 2.0 so that you can grant your applications secure delegated access to the resources of your customers organizations. VMware Cloud Partner Navigator supports OAuth 2.0 server-to-server apps which authorize actions through an access token, issued directly to your application.

What is OAuth 2.0?

OAuth 2.0 is an authorization protocol that lets you grant your applications secure access to your resources. Your client is authorized through an access token. The access token has a scope which defines which resources the app can access. For information about OAuth 2.0, see https://tools.ietf.org/html/rfc6749#page-8, or look at this blog post called OAuth 2.0 Simplified at https://aaronparecki.com/oauth-2-simplified/.

How does OAuth work with VMware Cloud Partner Navigator?

VMware Cloud Partner Navigator supports the OAuth 2.0 client credentials grant type, which grants your applications access to the resources of your organization without the need of user authorization. To supply credentials for your applications, you create a server-to-server OAuth 2.0 app in VMware Cloud Partner Navigator and define the scope of its access token. Then your applications use the supplied OAuth credentials to retrieve the access token and gain access to the resources defined in the scope. The scope is defined in terms of organization roles as described in Reseller roles and permissions.

Who creates OAuth apps?

Only a Reseller Administrator user can create and manage OAuth apps in a reseller organization.

How do I set up an OAuth server-to-server app?

The process of setting up an OAuth app is two-fold. First, you create the OAuth app in an organization of yours and define the scope of its access token. Then, to enable the app's access to the organization's resources, you add the app to the same organization in which it was created. You cannot add OAuth apps created in different organizations.

To create an OAuth app:

  1. On the VMware Cloud Partner Navigator toolbar, click Organization > OAuth Apps.

  2. Click Create App > Continue.

  3. Complete the OAuth app details and define its scope.

    1. Enter a name and description for the app.

    2. Set the time to live of the OAuth app's access token.

    3. To define the scope of the OAuth app's access token, select organization roles.

    4. Click Create.

  4. Copy the received credentials or download a JSON file, and click Continue.

At this point the OAuth app has been created in your VMware Cloud Partner Navigator organization but not yet granted access to its resources. To grant it access, you must add the app to your organization.

To add an OAuth app to an organization:

  1. On the VMware Cloud Partner Navigator toolbar, click Identity & Access Management > OAuth Apps.

  2. Click Add App.

  3. Select your organization, then browse and select an OAuth app.

    The page lists the organization and service roles that will be assigned to the OAuth app instance.

  4. Review the OAuth app details and click Add.

The OAuth app is added to your VMware Cloud Partner Navigator organization and granted access to its resources.

To authorize the actions of your applications, use the provided OAuth credentials in your script's API calls.

How do I manage OAuth apps?

Refer to the following table for a list of OAuth management functions you can perform.

To...

Do this...

View the OAuth apps that have access to your organization.

Click Identity & Access Management > OAuth Apps.

Add an OAuth app created in the same organization

  1. Click Identity & Access Management > OAuth Apps.

  2. Click Add OAuth App.

  3. Select your organization.

  4. From the OAuth App drop-down menu, select the app you want to grant access to this organization.

  5. Review the App Details and click Add.

Restrict an added OAuth app from accessing the resources of your organization

  1. Click Identity & Access Management > OAuth Apps.

  2. From the list of OAuth apps, select the app you want to prevent from accessing the resources of your organization.

  3. Click Remove.

To view the apps created in your organization.

Click Organization > OAuth Apps.

Here you can view all apps created in your organization.

To manage the existing OAuth apps created in your organization.

Click Organization > OAuth Apps and select the app you want to manage:

  • To modify the OAuth app, click Edit.

    Note:

    If you change the scoping of an app, your changes are not synchronized with instances of the app which are already added to any of your organizations. To update the scoping of previously added app instances, you must first remove them from Identity & Access Management > OAuth Apps , and then add them again.

  • To remove an app, click Delete.

    Note:

    This action cannot be reverted. Any application using these client credentials will no longer be able to access protected resources and the credentials will be invalidated.