{"action":"created","comment":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/86913395","pull_request_review_id":7547247,"id":86913395,"diff_hunk":"@@ -0,0 +1,318 @@\n+---\n+layout: docs_page\n+title: Configuration Changes Required for API Access Management Beta Update\n+---\n+\n+## Configuration Changes Required for API Access Management Beta Update\n+\n+Okta provides the private authorization server for OAuth 2.0 (Beta).\n+However, with release 2016.45, you can use a shared authorization server instead, which provides several benefits:\n+\n+* You created a separate private authorization server for each client, which required you to set scopes and claims \n+  and group filters for each client on a separate server, but keeping many configurations in sync is challenging.\n+  With the shared resource server, you can create a single configuration of scopes, claims, and Group filters, and\n+  assign multiple clients. \n+* With the shared resource server, you can create one server per API or other service that you need to secure.\n+  When you bring a new client online, you can choose which combination of services it can use by choosing the\n+  appropriate combination of authorization servers. This ensures that access is being granted with the same permissions\n+  (scopes) each time.\n+\n+Since a shared authorization server meets the same needs as the current private authorization server,\n+we are deprecating the private authorization server. All orgs using the private authorization server must create \n+a shared authorization server and manually transfer their OAuth 2.0 configuration information\n+using the instructions provided. \n+\n+> Do this within two weeks after preview release 2016.45 is available, currently scheduled for early November. \n+After that date, the private authorization server and all configuration information for it (scopes, claims, and groups claims)\n+will be removed, so be sure to recreate your configurations in the shared authorization server before this date. \n+\n+## Prerequisites\n+\n+* You are an OAuth 2.0 Beta program participant or and OpenID Connect Early Access program participant, and you have existing scope, \n+  claim, or group claim configurations set up for either OpenID Connect ID Token or OAuth 2.0 Access Token, and want to keep these configurations.\n+* You have Admin access to the org where the private authorization server is set up. You need this access\n+  to collect the existing information and manually transfer it to the new shared authorization server that you will create.\n+\n+## Instructions\n+\n+To move from the private authorization server to the shared authorization server:\n+\n+1. [Create a new Authorization Server](#step-one-create-a-new-authorization-server).\n+2. [Copy your scopes, claims, and group claims configurations to the new authorization server](#step-two-copy-your-configuration).\n+3. [Test your shared authorization server configuration](#step-three-test-your-configuration).\n+4. [Change your clients to use the new endpoints](#step-four-change-your-clients-to-consume-the-new-endpoints).\n+\n+> You can create more than one shared authorization server. However, to ensure the move is made correctly,\n+we recommend you only create one shared authorization server, complete these steps, and test it before making any other changes.\n+\n+### Step One: Create a New Authorization Server\n+\n+In the Okta user interface, create a new authorization server:\n+\n+1. In the Okta Admin user interface, go to **Security > API**.\n+2. Click **Add Authorization Server**.\n+3. Enter a unique name that indicates the purpose of this authorization server.\n+4. Enter the **Resource URI**, your base URL for the resources you are storing in the authorization server.\n+   For example, if your resource is `mycorp.mydomain.com/api/cats`, the resource URI is `mycorp.mydomain.com/api`.\n+   This value becomes the `audience` in the Access Token.\n+5. Select **Save**.\n+\n+### Step Two: Copy Your Configuration\n+\n+Copy the custom scopes, custom claims, and group claims configuration from the private authorization server \n+to the shared authorization server:\n+\n+For ID Tokens:\n+\n+1. Navigate to **Applications > Applications** and select an app.\n+2. Select **Sign On**.\n+3. Collect the information about **Token Credentials**: automatic or manual. WHERE DOES THIS GO?\n+4. Collect all information about the **OpenID Connect ID Token**: `Claims` and `Groups claim`. \n+    * The `issuer` and `audience` will change, so you don't need to record them.\n+    * If you have a Groups claim, you'll have to create a scope for it in the shared authorization server. Groups scope is not a reserved scope in the shared authorization server.\n+5. Select **Security > API**. \n+6. Select your authorization server name.\n+7. Select **Scopes** and add any of the scopes you collected. Created a scope for groups if you had a groups claim in the private authorization server.\n+8. Select **Claims** and add any of the claims you collected.\n+\n+For Access Tokens:\n+\n+1. Navigate to **Applications > Applications** and select an app.\n+2. Select **Authorization Server**.\n+3. Collect all the information about **OAuth 2.0 Access Token**: custom `Scopes`, `Claims`, and `Groups claim`.\n+    * The `issuer` and `audience` will change, so you don't need to record them.\n+    * If you have a Groups claim, you'll have to create a scope for it. Groups scope is not a reserved scope in the shared authorization server.\n+4. Select **Security > API** \n+5. Select your authorization server name.\n+6. Select **Scopes** and add any of the scopes you copied in step 2. If you had a groups claim in the private authorization server, you'll need to create a groups scope.\n+7. Select **Claims** and add any of the claims you copied in step 2.\n+\n+>Hint: Instead of copying strings from the UI to a text document, you can take screenshots, or open two browsers, one accessing\n+ the old configuration (steps 1-4), and one showing the new configuration (steps 5-8).\n+\n+The final configuration step is to create access policies for your new authorization server. \n+The private authorization server provided a single default access policy that allows all users to receive all claims.\n+The shared authorization server allows you to control which users receive which claims, so you must set the access policy\n+to ensure behavior is the same between private and shared authorization server.\n+\n+To copy the default access policy from the private authorization server:\n+\n+1. In **Security > API**, select the name of the authorization server you are configuring.\n+2. Select **Access Policies > Add Rule**.\n+3. Enter a name for the rule.\n+4. Select **User is assigned this client**\n+5. Enter every custom scope name.\n+4. Select **Create Rule**.\n+\n+### Step Three: Test Your Configuration\n+\n+Send an API request for a token to the old private authorization server and the new shared authorization server.\n+Both tokens should contain the same scope and claim information. \n+\n+<Link to the api doc for the correct operations to use.>\n+\n+### Step Four: Change Your Clients to Consume the New Endpoints\n+\n+Change the endpoints in your clients to the new well-known endpoint for the authorization server you created.\n+\n+To change the well-known endpoint:\n+\n+1. Find the authorization server ID for your new authorization server. It's displayed in the **Metadata URI** field of the\n+settings tab ( **Security > API > Authorization Server** ).\n+1. Use the Discovery Document for [OpenID Connect clients](http://developer.okta.com/docs/api/resources/oidc.html#openid-connect-discovery-document) \n+or [OAuth 2.0 clients](http://developer.okta.com/docs/api/resources/oauth2.md#authorization-server-metadata) to identify all endpoints that must be changed, as shown in the example below.","path":"_source/_docs/api/resources/resource-server-beta/migrate-private-as-to-shared-as.md","position":null,"original_position":123,"commit_id":"ddcf26c0948f365406052a8295d9dc9e0fcfbc69","original_commit_id":"d01ff1346b03889b2d3c8e77cecb3b85b8e53d77","user":{"login":"mystiberry-okta","id":17009066,"avatar_url":"https://avatars.githubusercontent.com/u/17009066?v=3","gravatar_id":"","url":"https://api.github.com/users/mystiberry-okta","html_url":"https://github.com/mystiberry-okta","followers_url":"https://api.github.com/users/mystiberry-okta/followers","following_url":"https://api.github.com/users/mystiberry-okta/following{/other_user}","gists_url":"https://api.github.com/users/mystiberry-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/mystiberry-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mystiberry-okta/subscriptions","organizations_url":"https://api.github.com/users/mystiberry-okta/orgs","repos_url":"https://api.github.com/users/mystiberry-okta/repos","events_url":"https://api.github.com/users/mystiberry-okta/events{/privacy}","received_events_url":"https://api.github.com/users/mystiberry-okta/received_events","type":"User","site_admin":false},"body":"Fixed.","created_at":"2016-11-08T02:32:15Z","updated_at":"2016-11-08T02:32:15Z","html_url":"https://github.com/okta/okta.github.io/pull/451#discussion_r86913395","pull_request_url":"https://api.github.com/repos/okta/okta.github.io/pulls/451","_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/86913395"},"html":{"href":"https://github.com/okta/okta.github.io/pull/451#discussion_r86913395"},"pull_request":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/451"}}},"pull_request":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/451","id":90445871,"html_url":"https://github.com/okta/okta.github.io/pull/451","diff_url":"https://github.com/okta/okta.github.io/pull/451.diff","patch_url":"https://github.com/okta/okta.github.io/pull/451.patch","issue_url":"https://api.github.com/repos/okta/okta.github.io/issues/451","number":451,"state":"closed","locked":false,"title":"draft of private AS to shared AS instruction","user":{"login":"mystiberry-okta","id":17009066,"avatar_url":"https://avatars.githubusercontent.com/u/17009066?v=3","gravatar_id":"","url":"https://api.github.com/users/mystiberry-okta","html_url":"https://github.com/mystiberry-okta","followers_url":"https://api.github.com/users/mystiberry-okta/followers","following_url":"https://api.github.com/users/mystiberry-okta/following{/other_user}","gists_url":"https://api.github.com/users/mystiberry-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/mystiberry-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mystiberry-okta/subscriptions","organizations_url":"https://api.github.com/users/mystiberry-okta/orgs","repos_url":"https://api.github.com/users/mystiberry-okta/repos","events_url":"https://api.github.com/users/mystiberry-okta/events{/privacy}","received_events_url":"https://api.github.com/users/mystiberry-okta/received_events","type":"User","site_admin":false},"body":"I have a few questions, mostly about the last step:\n1. is Step Four correct? It seemed odd to me that I never saw an AS ID (not sure I have enough things set up in my test org), worried I missed something. Also, the reference to validation is vague, any other details I can add?\n2. Is it too confusing having the example at the end of Step Four instead right after Step Four.Step1? I had mondo formatting problems. \n3. I am not sure whether to call the private AS an AS or a resource server, it's both ways in doc (AS in the UI), and Cindy mentioned it's not really an AS. I tried to go with 'private resource server' and 'shared authorization server', is that okay? Easy to change if not.\n\nDon't worry about file names or directory locations, we'll get that all sorted out.\n","created_at":"2016-10-21T21:19:42Z","updated_at":"2016-11-08T02:32:15Z","closed_at":"2016-11-04T21:37:13Z","merged_at":"2016-11-04T21:37:13Z","merge_commit_sha":"111afa3ea541640f7777c583a7e79f5a7f23e977","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/okta/okta.github.io/pulls/451/commits","review_comments_url":"https://api.github.com/repos/okta/okta.github.io/pulls/451/comments","review_comment_url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/okta/okta.github.io/issues/451/comments","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/ddcf26c0948f365406052a8295d9dc9e0fcfbc69","head":{"label":"okta:doc-104589","ref":"doc-104589","sha":"ddcf26c0948f365406052a8295d9dc9e0fcfbc69","user":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"repo":{"id":10953058,"name":"okta.github.io","full_name":"okta/okta.github.io","owner":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":false,"url":"https://api.github.com/repos/okta/okta.github.io","forks_url":"https://api.github.com/repos/okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/okta/okta.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/okta/okta.github.io/deployments","created_at":"2013-06-25T23:22:38Z","updated_at":"2016-10-24T16:56:41Z","pushed_at":"2016-11-08T01:55:29Z","git_url":"git://github.com/okta/okta.github.io.git","ssh_url":"git@github.com:okta/okta.github.io.git","clone_url":"https://github.com/okta/okta.github.io.git","svn_url":"https://github.com/okta/okta.github.io","homepage":"http://developer.okta.com/","size":35770,"stargazers_count":15,"watchers_count":15,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":43,"mirror_url":null,"open_issues_count":15,"forks":43,"open_issues":15,"watchers":15,"default_branch":"master"}},"base":{"label":"okta:master","ref":"master","sha":"92e1352bf6514d237db619b54d355fb1049f6592","user":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"repo":{"id":10953058,"name":"okta.github.io","full_name":"okta/okta.github.io","owner":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":false,"url":"https://api.github.com/repos/okta/okta.github.io","forks_url":"https://api.github.com/repos/okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/okta/okta.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/okta/okta.github.io/deployments","created_at":"2013-06-25T23:22:38Z","updated_at":"2016-10-24T16:56:41Z","pushed_at":"2016-11-08T01:55:29Z","git_url":"git://github.com/okta/okta.github.io.git","ssh_url":"git@github.com:okta/okta.github.io.git","clone_url":"https://github.com/okta/okta.github.io.git","svn_url":"https://github.com/okta/okta.github.io","homepage":"http://developer.okta.com/","size":35770,"stargazers_count":15,"watchers_count":15,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":43,"mirror_url":null,"open_issues_count":15,"forks":43,"open_issues":15,"watchers":15,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/451"},"html":{"href":"https://github.com/okta/okta.github.io/pull/451"},"issue":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/451"},"comments":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/451/comments"},"review_comments":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/451/comments"},"review_comment":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/451/commits"},"statuses":{"href":"https://api.github.com/repos/okta/okta.github.io/statuses/ddcf26c0948f365406052a8295d9dc9e0fcfbc69"}}}}
{"actor":{"display_login":"mystiberry-okta"}}