[SPN9-STS10] How to set-up and use Oauth2 as an authentication method for API requests

Introduction

Starting SPNS 9.5 the new OAuth2 authentication mechanism has been introduced. This article aims to guide thoroughly on how to configure your system to use oauth2 then how use Oauth2 (Client credentials flow) as an authentication method for API requests (for instance a translation). To perform this we need an user with Admin role/access to configure and then a user to use Oauth2.

In Oauth2 workflow, entities involved are:
- Authorization Server: systran-ses-console component that grants access to resource.
- Resource Server: systran-ses-gateway component that gives access to translation.
- Client: we will use cUrl

Main steps:

1) Configure (or check configuration of) your SPN9 server for Oauth2
2) Translate using Oauth2 authentication
3) Advanced checks

1) Configure (or check configuration of) your SPN9/STS10 server for Oauth2

1.1) Prerequisites

- a valid FQDN to access the Web UI: https://CONSOLE_PUBLIC_URL
- a SSL certificate signing it.

1.2) Configure your SPN9/STS10 server

1. Make sure that the Public URL of the SYSTRAN Console is configured using your FQDN.  From Web UI: Administration > Settings > Console Settings > Public URLs. If not, update it, restart systran-ses-console service and test it.

systemctl restart systran-ses-console

2. Ensure Public URL is define on SYSTRAN Gateway side. To do that, first, let's create a config file using your server hostname. If this file already exists, you have to update it.

touch /opt/systran/apps-node/translation-gateway/config/`hostname`.yaml
chown systran:systran /opt/systran/apps-node/translation-gateway/config/`hostname`.yaml

Set Gateway config file (adjust URL variable first)

URL=[Console Public URL]

echo -e "Gateway:
  InputInterfaces:
    translate-api:
      authorizationUrl: https://$URL
      ses8Url: https://$URL
  
      OfficePluginsAPI:
        host: $URL
        port: 8904
        Settings:
          authenticationMode: spnsOAuthPkce # [spnsOAuthPkce, spnsPro]
          resourceUrl: https://$URL:8904
          authorizationUrl: https://$URL/oidc
" > /opt/systran/apps-node/translation-gateway/config/`hostname`.yaml

/!\ YAML files require proper indentation /!\
(Note that we will also add the Office 365 entry valid from version 9.7+)

then run the command

systemctl restart systran-ses-gateway

Note 1: If you use Firewalld to redirect external 443 port to default 3443 Console port, note that you have to add the following rule to ensure internal connection will not be blocked:

firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -p tcp -o lo --dport 443 -j REDIRECT --to-ports 3443

Note 2: If you use "multiple frontends" (Gateway services dispatcher on multiple servers ), ensure the following file is the same across your servers: /opt/systran/apps-node/translation-gateway/certificates/credentials.json

You also need to copy contents of that file if you are performing a DB migration to a different server (SPN9 --> STS10 for example).

Note 3: For integration with Microsoft latest addins (SYSTRAN Translator for Word, Excel and PowerPoint ; SYSTRAN Translator for Outlook), SYSTRAN App and Chrome&Firefox extensions (through "Login" option) you need to be at least release SPNS 9.8.2 in order to meet the OAuth Device Flow authentication.

1.3) Quick configuration Checklist

To ensure your configuration is valid, you can:
1) Check you can connect to Web UI using a valid FQDN
2) Ensure the same FQDN is used in Gateway
3) Test you can connect to this FQDN from SSH via:

curl https://CONSOLE_PUBLIC_URL

2) Translate using Oauth2 authentication

2.1) Step 1 - Generate Oauth2 (Client credentials flow) credentials

Required credentials are a Client Id and a Client Secret. If you already have it, go to the next step.

From 9.6, this can be done via the Web UI...

1) Connect to https://CONSOLE_PUBLIC_URL/user or personal info

2) Click as described below:

Fill up with a Client Name and then click on submit.

On the next screen take a note of the client ID and client secret (visible one time; only upon creation)

...Or via an API call

It requires a Legacy API Key:

curl --location --request POST '<https://CONSOLE_PUBLIC_URL>/oidc/reg?apikey=<API_KEY>' \
--header 'Content-type: application/json' \
-d 
'{
"client_name": "[CLIENT_NAME]",
"grant_types": ["client_credentials"],
"introspection_endpoint_auth_method": "none",
"revocation_endpoint_auth_method": "none",
"response_types": [],
"redirect_uris": ["https://<CONSOLE_PUBLIC_URL>"]
}'

Response will be a JSON including a client_id and a client_secret.

2.2) Step 2 - Get a Token

Now we need to generate an access token to authenticate.

curl --location --request POST '<https://CONSOLE_PUBLIC_URL>/oidc/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<client_id>' \
--data-urlencode 'client_secret=<client_secret>'

2.3) Step 3 - Translate!

Now use this access token to authenticate and translate!

Token should be added in the header and endpoint is SYSTRAN Gateway

--header 'Authorization: Bearer <ACCESS_TOKEN>'

Example

curl --location --request POST '<https://GATEWAY_PUBLIC_URL>/translation/text/translate' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <access_token>' \
-d '{"input" : "This is a test using oauth2!", "source" : "en","target" : "fr"}'

Note: you may require to explicitly specify which port to use (eg. 8904) when sending a translation request. For instance, a test with a real-life server may look like the following:

curl --location --request POST 'https://clientName.mysystran.com:8904/translation/text/translate' \

3) Advanced checks

In some cases, you may have to re-set the Redirect URI in the existing credentials (URI redirect error for instance). Prerequisite is to identify your Console Public URL.

First step is to connect to MongoDB:

mongo -u XXXXXXXXXXXX-p XXXXXXXXXXXX--authenticationDatabase admin

Switch to user DB

use user

And list credentials (if too many credentials are displayed, see note below)

db.getCollection('client').find({}).pretty()

If you identify redirect_uris entries with an "OLD_URL":

{
  [...]
    "redirect_uris": ["https://OLD_URL/oidc/cb"],
  [...]
}

You will have to update it:

db.getCollection('client').update({"payload.redirect_uris": "https://OLD_URL/oidc/cb"},
{"$set":{"payload.redirect_uris.$":"https://[Console Public URL]/oidc/cb"}}
, {multi: true}
)

And finally restart console:

systemctl restart systran-ses-console

Note:

 - In most cases, OLD_URL is localhost:3443

 - If too many credentials are displayed, you can filter on credentials having the wrong URL:

db.getCollection('client').find({"payload.redirect_uris.0": { $exists: true, $ne: "https://[Console Public URL]:3443/oidc/cb" }})