Setting up external Tyk Identity Broker

Flow for using ActionType GenerateOAuthTokenForClient and using MICROSOFT ENTRA as IDP

1. Create an API with Oauth2.0 Authentication
   
   
    
2. Create Policy for this API
   
    
3. API tab> Find the created API> Actions> Oath clients
   
    
4. Add New Client and click the created Client. Add redirect URI and link the created policy
   
    
5. Make sure that you have installed external TIB and set config and profiles.json. Here's how I set it on my docker-compose:
   
   
    

6. Tib.conf
   
   {
     "Secret": "tib-secret",
     "HttpServerOptions": {
       "UseSSL": false,
       "CertFile": "",
       "KeyFile": ""
     },
     "log_level": "debug",
     "BackEnd": {
       "Name": "in_memory",
       "IdentityBackendSettings": {
         "Hosts": {
           "tyk-redis": "{REDISPORT}"
         },
         "Password": "",
         "Database": 0,
         "EnableCluster": false,
         "MaxIdle": 1000,
         "MaxActive": 2000 
       }
     },
     "TykAPISettings": {
       "GatewayConfig": {
         "Endpoint": "{GATEWAY_URL}", 
         "Port": "{GatewayPORT}",
         "AdminSecret": "{GATEWAY_SECRET}"
       }
     }
   }

7. 
   My profiles1.json mounted in the tib volume above.

   [
     {
       "ActionType": "GenerateOAuthTokenForClient",
       "ID": "{profileIDyouset}",
       "IdentityHandlerConfig": {
         "DashboardCredential": "{DASHBOARD USER ACCESS CREDENTIAL Please use Admin user}",
         "DisableUpdate":false,
         "DisableOneTokenPerAPI": false,
   		"OAuth": {
   			"APIListenPath": "{API_LISTENPATH from STEP 1}",
   			"BaseAPIID": "{API_ID from STEP1}",
   			"ClientId": "{OAUTH CLIENT ID from STEP4}",
   			"RedirectURI": "{REDIRECT_URI you set from STEP4}",
   			"ResponseType": "token",
   			"Secret": "{OAUTH CLIENT SECRET from STEP4}",
               "NoRedirect": false
   		}
       },
       "MatchedPolicyID":"{POLICY ID from STEP3}",
       "OrgID":"{YOUR ORG ID}",
       "ProviderConfig": {
         "CallbackBaseURL": "http://localhost:3010",
         "FailureRedirect": "http://localhost:3010/?fail=true",
         "UseProviders": [
           {
             "Name": "openid-connect",
             "Key": "{ENTRA_APP_ID}",
             "Secret": "{ENTRA_APP_SECRET}",
             "DiscoverURL": "https://login.microsoftonline.com/{ENTRA_TENANT_ID}/v2.0/.well-known/openid-configuration",
             "Scopes": ["openid", "profile", "email"]
           }
         ]
       },
       "ProviderName": "SocialProvider",
       "ReturnURL": "{RETURN URL YOU WANT TO SET}",
       "Type": "redirect"
     }
   ]

    

8. Callback URL to set in ENTRA APP: http://localhost:3010/auth/{profileID}/openid-connect/callback

9. Login URL: http://localhost:3010/auth/{profileID}/openid-connect > Call this URL to login and if successful it will bring you to your Redirect URI.