TQ Data Foundation as an OAuth API client

Some TQ Data Foundation features require access to external APIs that are protected with OAuth. The external API may be another Data Foundation instance that is configured with OAuth Authentication. This page describes how to configure Data Foundation so that it can act as an OAuth client in these scenarios.

Configuring Data Foundation as an OAuth API client

Note

When configuring this method of authentication, it is helpful to have a technical resource familiar with the OAuth 2.0 Authorization Server to assist with the configuration. TopQuadrant is unable to assist with specific configuration options for each customer’s Authorization Server.

  • Using Data Foundation as an OAuth 2.0 client is configured through Server Administration. Browse to your Data Foundation webapp UI, and navigate to the OAuth Parameters Section of the System Configuration Parameters Admin Page.

  • The Token Request URL, Client ID, Client Secret, and Scope depend on the Authorization Server. See the Authorization Server examples below.

  • The Relying party identifier is a URL that identifies the resource being accessed. When Data Foundation makes external API requests to a URL, and the URL starts with this Relying party identifier, then Data Foundation will attempt authentication with this OAuth configuration. For example, if the resource being accessed is another Data Foundation instance: https://your.edg.server/edg/tbl/

Authorization Server Examples

Okta

Under OAuth Parameters, fill in the following:

  • Token Request URL https://your.okta.com/oauth2/default/v1/token

  • Client ID xxxxxxxxxxxxxxxxxxxx (obtained by your Okta administrator for this Application)

  • Client Secret obtained by your Okta administrator for this Application

  • Scope obtained by your Okta administrator for this Application (if required)

Microsoft Entra ID

Under OAuth Parameters, fill in the following:

  • Token Request URL https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/v2.0/token

  • Client ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (obtained by your Entra administrator for this Application)

  • Client Secret obtained by your Entra administrator for this Application

  • Scope api://xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/.default (obtained by your Entra administrator for this Application)

Amazon Cognito

Under OAuth Parameters, fill in the following:

  • Token Request URL https://your.amazoncognito.com/oauth2/token

  • Client ID xxxxxxxxxxxxxxxxxxxxxxxxxx (obtained by your Cognito administrator for this Application)

  • Client Secret obtained by your Cognito administrator for this Application

  • Scope https://your.resource.server/your.scope (obtained by your Cognito administrator for this Application)

See also