- Does Apigee natively support PAR?
No; there's nothing in the OAuthV2 policy documentation that states anything about PAR.
- If not, are there any plans or roadmap items to support PAR in Apigee?
I don't know the answer to that. Maybe the product team does.
- What are the recommended best practices or workarounds for implementing PAR with Apigee?
I don't think we have a formal set of "Recommended best practices." The nice thing about the Apigee policy set is that you can build what you want. So if you would like to build an RFC 9126-style authorization request, you can do that.
- have the client produce the appropriate POST request, with all the required parameters
- if you want to use JWT assertions for client authentication, you can do that
- the Apigee endpoint that receives the request should do all the checks as prescribed in RFC 9126:
- make sure request_uri is not provided
- authenticate the client in whatever way is appropriate
- validate the response_type, scope, redirect_uri, and all the other pieces in the request. This is possibly by using AccessEntity in Apigee and checking those values against the retrieved data there (eg, redirect_uri or scope)
- If everything is good, then produce a ransom string for use in the redirect_uri in the response. Store all of the relevant data for the client request in a JSON, that you store , in KVM.
- Return the JSON response to the client
- Subsequently the client can play back the request to the /authorize endpoint using the unique time-limited request_uri
- Apigee can validate all of that data again, and then execute OAuthV2-GenerateAccessToken
What problem are you solving with PAR? Can you say more about your particular scenario?
LinkedIn
Twitter
