.. include:: /includes.rst.txt

.. comments - headings

   # with overline, for parts
   * with overline, for chapters
   = for sections
   - for subsections
   ^ for subsubsections
   " for paragraphs
   * for H5
   + for H6

.. _edg_as_oauth_client:

TQ Data Foundation as an OAuth API client
-----------------------------------------

Some TQ Data Foundation features require access to external APIs that are protected with OAuth. The external API may be another Data Foundation instance that is configured with :ref:`OAuth Authentication <oauth_authentication>`. This page describes how to configure Data Foundation so that it can act as an OAuth client in these scenarios.

Configuring Data Foundation as an OAuth API client
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.. note::
   When configuring this method of authentication, it is helpful to have a technical resource familiar
   with the OAuth 2.0 Authorization Server to assist with the configuration.  TopQuadrant is unable to 
   assist with specific configuration options for each customer's Authorization Server.

* Using Data Foundation as an OAuth 2.0 client is configured through Server Administration.  
  Browse to your Data Foundation webapp UI, and navigate to the :ref:`OAuthParametersSection` of the :ref:`SystemConfigurationParametersAdminPage`.
* The **Token Request URL**, **Client ID**, **Client Secret**, and **Scope** depend 
  on the Authorization Server.  See the Authorization Server examples below.
* The **Relying party identifier** is a URL that identifies the resource being accessed.  
  When Data Foundation makes external API requests to a URL, and the URL starts with this Relying 
  party identifier, then Data Foundation will attempt authentication with this OAuth configuration. 
  For example, if the resource being accessed is another Data Foundation instance: ``https://your.edg.server/edg/tbl/``


Authorization Server Examples
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Okta
""""

Under OAuth Parameters, fill in the following:

* **Token Request URL**  ``https://your.okta.com/oauth2/default/v1/token``
* **Client ID** ``xxxxxxxxxxxxxxxxxxxx`` (obtained by your Okta administrator for this Application)
* **Client Secret** obtained by your Okta administrator for this Application
* **Scope** obtained by your Okta administrator for this Application (if required)

Microsoft Entra ID
""""""""""""""""""

Under OAuth Parameters, fill in the following:

* **Token Request URL**  ``https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/v2.0/token``
* **Client ID** ``xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`` (obtained by your Entra administrator for this Application)
* **Client Secret** obtained by your Entra administrator for this Application
* **Scope** ``api://xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/.default`` (obtained by your Entra administrator for this Application)

Amazon Cognito
""""""""""""""

Under OAuth Parameters, fill in the following:

* **Token Request URL**  ``https://your.amazoncognito.com/oauth2/token``
* **Client ID** ``xxxxxxxxxxxxxxxxxxxxxxxxxx`` (obtained by your Cognito administrator for this Application)
* **Client Secret** obtained by your Cognito administrator for this Application
* **Scope** ``https://your.resource.server/your.scope`` (obtained by your Cognito administrator for this Application)

See also
^^^^^^^^

* :ref:`oauth_authentication`