*******************************************************************

* OAuth: Try Now Scripts

*
*******************************************************************



Setup

========================================

1. Run addjq.sh to add the json parser library

2. Access Manager administrator should do some basic OAuth configuration:
   
a. Enable OAuth Protocol for the IDP cluster
   
b. Enable NAM_OAUTH2_DEVELOPER
 and NAM_OAUTH2_ADMIN Roles for Developer and Users
   c. Extend User store Schema and Add LDAP Attribute to store user's consent and refresh token information.
   
d. In OAuth -> Global Settings, configure:
      - Authorization Grant LDAP Attribute:
 set to the attribute added in previous step
      - CORS Domain: select Allow All
      - Grant Types: select all options
      - Token Types: select all options
      - Add Signing Certificate.

   e. Update Server



Steps To run
=========================================

1. Edit sampleScripts/config.txt file. Update the section marked System Settings.
   username      : OAuth developer username
   password      : OAuth developer password
   user_email    : Oauth developer email
   userstore     : name of the userstore configured for the IDP cluster (check with NAM administrator)
   user_dn       : Full DN like cn=admin, o=novell. Change domain as needed
   idpurl        : Identity server host and port
   scope_username: Non-developer user. 
   scope_password: Password for the above user.
   scope_email   : Email of the above user

2. Execute pre-requisite.scr. Make sure all the test have passed to setup the required environment. To review, verify the result_summary.txt file inside pre-requisite folder.

3. Once the basic environment is setup, you may run each script or "sampleScripts.sh" to run as batch



Use cases covered
=========================================

1. Resource Server Creation

2. Scope Creation

3.Client registration

4. Authorization Flow:
	
   a. Access token with Default server
        
   b. Access token with custom resource Server 
	
   c. Response_mode as form_post

   d. Response_mode as fragment

   e. Access token with pkceS256

   f. Access token with pkcePlain 

5. Implicit Flow:
	
   g. Access token with Default server
        
   h. Access token with custom resource Server 

   i. Response_mode as query

   j. Response_mode as form_post

6. Client Credential Flow:
	
   k. Access token with Default server
        
   l. Access token with custom resource Server
   
   m. Using Basic authentication(clientauthbasic)

7. Resource Owner Flow:
	
   n. Access token with Default server
       
   o. Access token with custom resource Server

   p. Using Basic authentication(clientauthbasic)

8. IDToken Flow:
	
   q. With authorization code flow 
	
   r. With Implicit flow

   s. Checking attributes added to the id token

9. Refresh Token Flow:
	
   t. Using body authentication(passing client id and client secret in request body) 
  
   u. Using Basic authentication(clientauthbasic)
 
10. Hybrid flow 
   
    v. Response_mode as form_post
    
    w. Response_mode as query
    
    x. Using Basic authentication(clientauthbasic)
 
11. Response type none

12. Token Verification with tokenInfo and UserInfo Endpoint

13. Token  Introspect endpoint 
   
    y. Authentication using bearer token

    z. Basic Authentication

    aa. Passing tampered token in the request

    ab. Body Authentication(passing client id and client secret in request body)


14. checking claims/permissions in access token

15. Validate Token when cors domain is passed in header

16. Token Revocation
   
    ac. Refresh Token Revocation
        
    ad. Refresh Token Revocation using global DeviceID

    ae. Refresh Token Revocation using Basic authentication(clientauthbasic)

17. Revoking the consent
