[Progress Communities] [Progress OpenEdge ABL] Forum Post: RE: PASOE: access to the HTTP Authorization header from web handler

[Michael Jacobs]

For OAuth2/JWT SSO support, the Spring Spring layer will populate the Client-Principal (delivered to the ABL application) with a validated JWT's payload claims. In your application you can access the JWT claims without parsing the JWT yourself, which ensures that the claims used by the Spring Security layer are also those used by your application. You also have the option of passing the full HTTP request Authorization header's JWT as a Client-Principal property "token_value" when you configure 'OEClientPrincipalFilter.forwardToken=true'. If present, the Client-Principal property 'token_value' can be used to build the Authorization header's 'bearer' scheme and downstream SSO to another OAuth2 resource.

Continue reading...