3.1.1 Allowing the Client Credentials OAuth2 logon mechanism

To allow access to MyID through server-to-server authentication, you must enable the Client Credentials OAuth2 logon mechanism.

1. In MyID Desktop, from the Configuration category, select Security Settings.

2. On the Logon Mechanisms tab, set the following option:

   • Client Credentials OAuth2 – set to Yes to enable server-to-server authentication, or No to disable it.

3. Click Save changes.

3.1.2 Creating a role for the external system

You are recommended to create a new role to be used for controlling access to MyID from the external system, rather than using an existing role. This allows you to maintain clear control over the MyID features the external system can access.

To create the role:

1. In MyID Desktop, from the Configuration category, select Edit Roles.

2. Click Add.

3. Give the role a name; for example, External API.

4. From the Derived from drop-down list, select Allow None.

5. Click Add.

6. Select the options that relate to the API features you want to be able to access through the API.

   See section 2.2, Accessing the API features for a list of which options map to the API end points.

   You are strongly recommended to select only those options that your external system will need to use.

7. Click Logon Methods.

8. For the role you created, select the Client Credentials OAuth2 logon mechanism, then click OK.

9. Click Save Changes.

For more information about using the Edit Roles workflow, see the Roles section in the Administration Guide.

3.1.3 Selecting a group for the user account

Before you create the user account, you must consider into which group you want to put the account. The group you select affects the scope of the user.

• If you want to restrict the access of the API to a particular group of users in MyID, put the API user into the same group, then select a scope of Department or Division when you specify the role for the user account.

• If you do not want to restrict the access of the API, you are recommended to create a separate group for the API user, then select a scope of All when you specify the role. Use the Add Group workflow in MyID Desktop to create the group; you can restrict this group to the API role only, and assign this as the default role with a scope of All.

  See the Adding a group section in the Operator's Guide for details of adding groups, and the Default roles section in the Administration Guide for details of setting default roles.

3.1.4 Creating a user account for the external system

Once you have created the role and decided which group to use, you can create the user account that the API will use to access MyID.

To add the user account:

1. In the MyID Operator Client, select the People category.

2. Click ADD.

3. Provide a First Name and Last Name; for example, External API.

4. Provide a Logon name; for example, api.external.

5. Select a Group for the user account.

   See section 3.1.3, Selecting a group for the user account above for considerations.

6. Select the Roles for the user account.

   Select the role you created for use by the external system. Set the appropriate scope; for example, All to allow the API to access data related to any user account in the system, or Division to restrict access data related to accounts in the same group as the API user, along with any subgroups.

7. Click SAVE.

Make sure you take a note of the logon name for the user; you need this for configuring the web.oauth2 web service.