Search code examples
authenticationosb

Send JWT authorization header via OSB 12C

I am using OSB 12C and am trying to send the authorization header to the external business service. i.e. there is no need for OSB to validate the JWT token, just pass it on to the business service.

I set the header in Postman when calling the proxy service:

enter image description here

I added a HTTP transport component in the proxy lane and another in the business lane. Then added a single log component in the pipeline and set it as a debug breakpoint.

For the HTTP business component, if I set authentication as None, the authorization header gets stripped away.

enter image description here

If I set as Custom:

enter image description here

I get an error page here with a 401 - Unauthorized when calling the proxy service and the pipeline doesn't get invoked at all.

Solution

  • The Authorization header is removed as a security constraint. You can bypass that contraint by adding "-Dcom.bea.wli.sb.transports.http.GetHttpAuthorizationHeaderAllowed=true" to the jvm See example here: https://thecattlecrew.net/2015/01/12/oracle-service-bus-12c-retrieving-username-from-http-basic-authentication-token-2/