Add OAuth v2.0 Policy to Verify Access Tokens

Attach an OAuth v2.0 policy in VerifyAccessToken mode to the actual API Proxy. This ensures only requests with a valid token (issued by the token proxy) can access iCWP APIs.

To add OAuth v2.0 policy:

  1. Select API proxy and click Policies.
  2. Click Edit.
  3. Select ProxyEndpoint.
  4. Select PreFlow.
  5. Under Security Policies, choose OAuth v2.0.
  6. Click on the + button to add the policy.
  7. Enter the Policy Name, set the Stream as Incoming Request and click Add.
  8. Replace the existing default content in the Body section with the following policy XML and click Update.
    Policy Message:
    <OAuthV2 async="false" continueOnError="false" enabled="true" xmlns="http://www.sap.com/apimgmt">
   <!-- By default, VerifyAccessToken expects the access token to be sent in an Authorization header. You can change that default using this element<AccessToken> -->
   <!-- If you want to pass access token in an customer header "access_token": -->
   <!-- <AccessToken>request.header.access_token</AccessToken> -->
   <!-- If you want to pass access token in query param "access_token": -->
   <!-- <AccessToken>request.queryparam.access_token</AccessToken> -->
   <!-- this flag has to be set when you want to work with third-party access tokens -->
   <ExternalAuthorization>false</ExternalAuthorization>
   <!-- valid values are GenerateAccessToken, GenerateAccessTokenImplicitGrant, GenerateAuthorizationCode ,
    RefreshAccessToken , VerifyAccessToken , InvalidateToken , ValidateToken  -->
   <Operation>VerifyAccessToken</Operation>
   <GenerateResponse enabled="true"/><SupportedGrantTypes/>
   <Tokens/>
</OAuthV2>
  9. Click Save.

    The Verify OAuth Access Token policy should be placed first in the execution flow. You can change its position by clicking on the navigation arrows.