Restrict OAUTH to specific webservice

[Former Member]

Hi All,

Is there a way i can use OAUTH webservice to have access of limited rest webservice resource.

i need only some of teh resources to be used by OAUTH client. other webservices cannot be used by that oauth client

[arvind-kumar_avinash]

I am not an expert on OAUTH implementation but I think you should able to do it using OAUTH scope. Please refer https://developer.okta.com/blog/2017/06/21/what-the-heck-is-oauth#oauth-scopes to see an illustration of what you can do using OAUTH scope.

[Former Member]

Hybris provides 2 filters ie. HybrisOauth2UserFilter and UserMatchingFilter which can be customized to check the resource path and write custom logic to suit your business rules.

[Former Member]

I did it different way. removed role ROLE_TRUSTED_CLIENT for oauth client. if any service have @security annotation, it will deny