Breeze Authorization Service Integration

Last Updated : Apr 29, 2021 |
Prolog information
Metadata
Keywords:
The Breeze Authorization Service Integration feature integrates the Avaya Breeze®Authorization service with Avaya Context Store Snap-in to grant access to applications using bearer tokens generated from the Context Store services.
Using this feature, you can configure any combinations of four values to grant access. You can also add or remove grants from the Authorization service in System Manager. This feature has the following user privileges:
  • Privileged: Used for privileged users
  • Standard: Used for standard users
    For information on adding grants to the Breeze Authorization configuration, see Assigning permissions to an authorization client section in Avaya Context Store Snap-in Reference.
The values and function applicable to these feature types are:
Value
Function
create
Applies to all ContextStore REST POST methods
delete
Applies to all ContextStore REST DELETE methods
read
Applies to all ContextStore REST GET methods
update
Applies to all ContextStore REST PUT methods

Integration with Context Store REST API

From Context Store Release 3.2 onwards, the Breeze Authorization Service Integration feature adds authorization to all the ContextStore REST API methods by adding a new header attribute to each REST request. The ContextStore REST API checks the authorization header only when the attribute is enabled in System Manager. You must start the value with a bearer followed by the token created.

Additional API Methods

Four REST methods are available for generating bearer tokens. These APIs are available only if you set the Enable Breeze Authorization Service attribute on ContextStoreREST to True.
Any user can use the Get token and Get token by scope APIs to generate tokens. However, the APIs are accessible only if you set the Require user for Breeze Authorization Service attribute on ContextStoreREST to False. If you set the attribute to True, then you can use only the more secure versions of the generate-token APIs, for which you require valid login credentials.
You can generate tokens using four new REST methods available in the ContextStore REST API as follows:
Name
REST Method
URL
Headers
Notes
Get Token
GET
/services/CSRest/cs/contexts/token/
You can disable this method in System Manager attributes
Get Token by Scope
GET
/services/CSRest/cs/contexts/token/scope/
scope
  • You can disable this method in System Manager attributes
  • <SCOPE> can be privileged or standard
Get Token for User
GET
/services/CSRest/cs/contexts/token/username/
  • username
  • password
Set HTTP headers user name and password
Get Token for User by Scope
GET
/services/CSRest/cs/contexts/token/username/scope/
  • scope
  • username
  • password
  • Set HTTP headers user name and password
  • <SCOPE> can be privileged or standard

ContextStore Rest attributes

As a part of the Breeze Authorization Service Integration feature, the ContextStore Rest snap-in provides the following three attributes:
Name
Values
Details
Address of Authorization Service
The fully qualified domain name (FQDN) or IP address of the cluster where the Authorization Service is installed.
Enter the FQDN or IP address of the UAC cluster with the Authorization service installed.
This setting is used by the Oceana Configuration service, where you must enter the Authorization service address.
Enable Breeze Authorization Service
  • true
  • false
Set the value to
This setting does the following:
  • It makes all of the ContextStoreRest APIs require tokens to use. Attempting to use one without a token gives an unauthorised error.
  • It enables the token-generation APIs mentioned in the table above.
Require user for Breeze Authorization Service
  • true
  • false
Set the value to
If you set this attribute on ContextStoreREST to
Note:
Setting the value to
This means that the user is no longer able to generate a token without providing valid user credentials.