Integrating Jama Connect with OAuth 2.0 as the identity provider (IDP)

Published Date: November 7, 2024

Validated: Yes

Audience: Everyone

Products and Versions Covered:

• Jama Connect®: Version 9.17 and later
  • Cloud/CVC
  • Self-hosted
  • REST API

Summary

Jama Connect supports OAuth 2.0 identity provider (IdP)-based authentication for REST API integrations. This authentication method allows an integration to send API requests on behalf of individual Jama Connect users rather than using a shared integration user's credentials.

This approach is useful for integrations where users need to access Jama Connect data from another application without first signing in to Jama Connect to populate or store Jama Connect credentials.

This article explains how to configure OAuth 2.0 using Okta as the identity provider and use Postman to obtain and test an access token.

Resolution

1. Create the application in Okta

Step 1. In Okta, go to Applications > Applications.

Step 2. Select Create App Integration.

Step 3. For Sign-in method, select OIDC - OpenID Connect.

Step 4. For Application type, select Web Application.

Step 5. Enter a name for the application.

Step 6. Enable:

• Refresh Token
• Allow wildcard * in sign-in URL redirect

Step 7. Enter the following callback URL for Postman:

https://oauth.pstmn.io/v1/callback

Step 8. Under Assignments, select Skip group assignment for now.

NOTE: Callback URL: Needed later. Use: https://oauth.pstmn.io/v1/callback

Step 9. Select Save.

2. Save the application details and assign a test user

Step 1. Open the application you created.

Step 2. On the General tab, save the following values. You will need them when you configure Postman. 

• Client ID
• Client Secret

Step 3. Open the Assignments tab and add a test user.

Important: The test user's email and username must match what's in Jama Connect.

3. Configure the API authorization server

Step 1. In Okta, go to Security > API.

Step 2. Select Add Authorization Server. 

Step 3. Enter a name for the authorization server. 

Step 4. Enter an Audience value. You can initially use a placeholder value and update it later. 

Step 5. Select the authorization server you created.

Step 6. Open Access Policies and add a new access policy.

Step 7. Add a rule to the policy.

Step 8. Under Client acting on behalf of a user, enable:

• Authorization code
• Implicit (hybrid)
• Resource Owner Password

4. Configure the issuer and save the OAuth endpoint information

Step 1. In Okta, go to Security > API.

Step 2. Select your authorization server. 

Step 3. Open the Settings tab and select Edit.

Step 4. Change the Issuer to the appropriate Okta URL. 

Step 5. Save the configuration.

Step 6. On the same page, open the Metadata URL.  

Step 7. Save the following values. You will use them when configuring Jama Connect and Postman:

• issuer — Issuer URL
• authorization_endpoint — Authorization URL
• token_endpoint — Access Token URL

5. Configure OAuth 2.0 in Jama Connect

Step 1. Sign in to Jama Connect as a system administrator.

Step 2. Go to System Administration > System Properties.

Step 3. Open API Authentication Properties.

Step 4. Enable IdP-based OAuth 2.0 Authorization Code API Authentication.

Step 5. For Issuer URL, enter the issuer value obtained from the Okta Metadata URL.

Step 5. Configure the Audience value. You can generate a new value or use the value configured for the Okta authorization server.

6. Configure OAuth 2.0 authorization in Postman.

Use Postman to exchange the OAuth credentials for an access token from the identity provider.

Step 1. Open the Authorization tab for the request.

Step 2. Configure the following:

• Type: OAuth 2.0
• Token: Enter a name for the token.
• Grant Type: Authorization Code
• Enable Authorize using browser.

Step 3. Enter the following values:

• Auth URL: The authorization_endpoint value from the Okta metadata.
• Access Token URL: The token_endpoint value from the Okta metadata.
• Client ID: The Client ID saved earlier.
• Client Secret: The Client Secret saved earlier.
• Scope: openid
• State: state

Step 4. Complete the authorization flow and generate an access token.

Step 5. Select the generated token as the OAuth 2.0 authorization token for the request.

7. Test the access token

Create a GET request in Postman that calls an appropriate Jama Connect REST API endpoint using the generated access token.

A successful request returns the requested Jama Connect data for the authenticated user.

To verify OAuth 2.0 requests in Jama Connect:

Step 1. Sign in as the system administrator. 

Step 2. Go to Logging > Log Viewer.

Step 3. Review the Connect Log Viewer for OAuth 2.0 requests. 

When the access token expires, obtain a new one before sending any additional authenticated requests.

Note: Jama Connect OAuth authentication does not currently support using refresh tokens to renew access. Monitor the returned expiration time for the access token and obtain a new token when necessary. Access token validity can vary across Jama Connect environments.

IMPORTANT: Access to the REST API is limited to users with a Named Creator Jama Connect license, including access to v1, labs, and SCIM endpoints. Users without a Named Creator Jama Connect license, including those with a Creator Float License, do not have access.

Additional Resources

• Success Programs
• Success Catalog
• Datasheets
• Request a Solution Offering or Training from the Success Catalog

Feedback

We welcome your input! Please sign in to leave any comments, suggestions, or ideas for improvement below.