Upgrade instructions versions 3.x
2.5.x to 3.0.0
Property changes
The credential configuration for token validation and the payload encryption policy have been replaced with a single set of credential properties.
The following properties have been replaced:
| Old property name | New property name |
|---|---|
| SECURITY_PROXY_ENGINE_ENCRYPTION_POLICY_USERNAME | SECURITY_PROXY_TOKEN_SERVER_API_CLIENT_ID |
| SECURITY_PROXY_ENGINE_ENCRYPTION_POLICY_PASSWORD | SECURITY_PROXY_TOKEN_SERVER_API_CLIENT_SECRET |
| SECURITY_PROXY_TOKEN_VALIDATION_SERVICE_CLIENT_ID | SECURITY_PROXY_TOKEN_SERVER_API_CLIENT_ID |
| SECURITY_PROXY_TOKEN_VALIDATION_SERVICE_CLIENT_SECRET | SECURITY_PROXY_TOKEN_SERVER_API_CLIENT_SECRET |
Embedded Resource gateway migration
If you are using The embedded resource gateway functionality you must update your Token Server configuration and Request mapper implementation.
Token Server configuration
Since version 3.0.0 of the Security Proxy it uses the Token introspection API of the Token Server to validate an access
token. You must update your Token Server configuration to ensure the Security Proxy can still validate access tokens. The Token Server documentation describes
how to configure an API client as resource server. Since you probably already have an API client configured for the
payload encryption policy you only need to add Token introspection as one of the allowed Token Server API's to the existing API client that was previously
only used to fetch the payload encryption policy.
Request mapper implementation
A request mapper implementation is used to map an access token into something
that your back-end understands. Since the Security Proxy now uses the Token Introspection API of the Token Server to get all information about an access token
the response containing the Access token metadata give to your request mapper implementation is also changed. The token_validation_result implementation
returns the sub property instead of the reference_id which contains the user id.