Sync client applications between Okta and Anypoint Platform when no client provider is integrated

External client providers can be integrated with Anypoint Platform to authorize client applications by applying an OAuth 2.0 policy to access your API. You need an OAuth 2.0 provider to use an OAuth 2.0 policy. In this blog, I will walk you through how to sync Okta client applications with Anypoint Platform client applications in Exchange manually when there is no external client provider integrated with Anypoint Platform for Dynamic Client registration.

Overview

Pre-requisites

1. Anypoint Platform Trial account with API Manager Entitlement.
2. Okta Trial account.
3. Access permissions to create an application and perform administration? in Okta
4. Organisational administration permissions in Anypoint Platform.

NOTE: All new trial accounts come with the required entitlements enabled by default.

Take away from this use case

1. How to access Anypoint Platform via Okta
2. How to create client application in Okta
3. How to create client applications using Anypoint platform REST API in Anypoint Exchange.

Okta setup

Create New Web App Integration

• Login to Okta
• Go to Application → Create a new app integration
• Sign-in method → OIDC - OpenID Connect
• Application type → Web Application
• Click Next
• Set Grant Type
• Client Credentials
• Authorization Code
• Set Assignments → Allow everyone in your organization to access
• Click Save

• Copy Client ID and Client Secret

Anypoint Platform Setup

• Login to Anypoint Platform.
• Go to API Manager → Create API Instance → Get API Instance ID.

• Go to API Manager → Get Business Group ID.

• Go to Access Management → Client Provider and Make sure no client provider is integrated.

Create Client Application in Anypoint Platform with same client credentials from Okta

Anypoint Platform does not provide any Web UI to replicate a client application from Okta to Anypoint Platform; rather it always creates a new set of client_id and client_secret. To bypass this gap, we can use an Anypoint Platform Exchange API, which lets you create a new client application with provided details (including client_id and client_secret).

Execute the curl command below and it will create a client application in exchange with the same credentials as Okta.

curl --location --request POST 'https://anypoint.mulesoft.com/exchange/api/v2/organizations/{business_group_id}/applications?apiInstanceId={API Instance ID}' 
--header 'Authorization: bearer {bearerToken} ' \
--header 'Content-Type: application/json' \
--data-raw '{
? "description": "Test Client",
? "name": "test-client-1",
? "grantTypes": [
? ? "password",
? ? "implicit",
? ? "client_credentials",
? ? "authorization_code",
? ? "refresh_token"
? ],
?"redirectUri": 
? ? "https://localhost:9090/callback"
? ],
? "url": "https://localhost:9090",
? "clientId": "client_id from Okta",
? "clientSecret": "client_secret from Okta"
}'        

• Invoking above Exchange API via Postman

Receive a successful response:

? ? "redirectUri": [
? ? ? ? "https://localhost:9090/callback"
? ? ],
? ? "name": "Client Web App",
? ? "description": "Test Client",
? ? "url": "https://localhost:9090",
? ? "clientId": "client_id from Anypoint",
? ? "clientSecret": "client_secret from Anypoint",
? ? "masterOrganizationId": "{Business_Group_ID}",
? ? "grantTypes": [
? ? ? ? "password",
? ? ? ? "implicit",
? ? ? ? "client_credentials",
? ? ? ? "authorization_code",
? ? ? ? "refresh_token"
? ? ],
      "id": 1340096
      ? ? "clientProvider": {
      ? ? ? ? "providerId": null
      ? ? }
      }        

• Verify client app getting created in Exchange

Conclusion

As you can see above, we are able to sync client web applications from Okta with Anypoint Platform. Until the Client Provider integration is done, we would need to keep these systems in sync manually. Here is how we can make it work: Whenever a new consumer (a system, like, ABC, XYZ, etc) requests to access MuleSoft API, they will need a client application to be created in both Okta and Anypoint Platform. The order of the client application creation must be - first create the client app in Okta and then replicate that client application in Anypoint Platform. Without replicating the client application in Anypoint, client_id validation won't be possible.

Author

Ashish Pardhi, MuleSoft Mentor at Apisero