Setting Up OAuth Token Hashing

WSO2 Identity Server (WSO2 IS) allows you to enable OAuth2 token hashing to protect OAuth2 access tokens, refresh tokens, consumer secrets, and authorization codes.

Follow the instructions below to set up OAuth token hashing:

1. Edit the <IS_HOME>/repository/conf/identity/identity.xml file,and do the following configuration changes under the <OAuth> section:

   • Change the value of the <TokenPersistenceProcessor> element as follows to enable token hashing:

     <TokenPersistenceProcessor>org.wso2.carbon.identity.oauth.tokenprocessor.HashingPersistenceProcessor</TokenPersistenceProcessor>

   • Change the value of the <EnableClientSecretHash> element to true as follows:

     <EnableClientSecretHash>true</EnableClientSecretHash>

   • Add the following configuration to specify the algorithm to use for hashing:

     <HashAlgorithm>SHA-256</HashAlgorithm>

2. Run the appropriate database command to remove the CONN_APP_KEY constraint from the IDN_OAUTH2_ACCESS_TOKEN table. For example, if you are using an H2 database, you need to run the following command:

   ALTER TABLE IDN_OAUTH2_ACCESS_TOKEN DROP CONSTRAINT IF EXISTS CON_APP_KEY

3. Follow the steps below to configure OAuth/OpenID Connect support for your client application:

   1. Start WSO2 IS and log on to the Management Console with your user name and password. For detailed instructions on how to start WSO2 IS, see Running the Product.

   2. Navigate to Service Providers > Add, enter a name for the new service provider, and then click Register.

   3. Expand the Inbound Authentication Configuration section, then expand the OAuth2/OpenID Connect Configuration, and click Configure.

   4. Specify appropriate values for the required fields. 

      Open

      

   5. Click Add. This displays values of the Consumer Key and the Consumer Secret for your service provider.

      Open

      

4. Click Show to view the exact Consumer Key and Consumer Secret.