Reference: Authentication

tags.id

Tag ID assigned to the authentication record.

createdDate

 The date when the authentication record was created in WAS, in UTC date/time format.

updatedDate

The date when the authentication record was updated in WAS, in UTC date/time format.

lastScan.date

The date when the web application (associated with the authentication record) was last scanned, in UTC date/time format.

lastScan.authStatus

Authentication status reported by the last web application scan: NONE, NOT_USED, SUCCESSFUL, FAILED or PARTIAL

isUsed

Indicates whether used by a web application or scan.

contents

(Keyword: FORM_STANDARD, FORM_CUSTOM, FORM_SELENIUM, SERVER_BASIC, SERVER_DIGEST, SERVER_NTLM, CERTIFICATE, OAUTH2_AUTH_CODE, OAUTH2_IMPLICIT, OAUTH2_PASSWORD, and OAUTH2_CLIENT_CREDS)

WebAppAuthRecord

(text) Details associated with the web application authentication record.

Use these parameters to create/update OAuth2 authentication record:

WebAppAuthRecord.oauth2Record.grantType - (Required if authentication type is OAuth2)(text) Valid values are: 1) NONE, AUTH_CODE, IMPLICIT, PASSWORD, and CLIENT_CREDS. NONE means no grant type is selected.

These are fields we support for each grant type:

1) AUTH_CODE - We support these fields for Authorization Code: 1) seleniumScript, 2) redirectUrl, 3) accessTokenUrl, 4) clientId (optional), 5) clientSecret (optional), 6) scope, (optional) and 7) accessTokenExpiredMsgPattern (optional)

Note: Selenium script is mandatory for Authorization Code. We support parametrized username and password in the selenium script. See “Create a Selenium script to parameterize username and password” in the WAS API guide.

2) IMPLICIT - We support these fields for Implicit: 1) seleniumScript, and 2) redirectUrl

Note: Selenium script is mandatory for Implicit. We support parametrized username and password in the selenium script. See “Create a Selenium script to parameterize username and password” in the WAS API guide.

3) PASSWORD - We support these fields for Resource Owner Password Credentials: 1) accessTokenUrl, 2) username, 3) password, 4) clientId (optional), 5) clientSecret (optional), 6) scope (optional), and 7) accessTokenExpiredMsgPattern (optional)

4) CLIENT_CREDS - We support these fields for Client Credentials: 1) accessTokenUrl, 2) clientId (optional), 3) clientSecret (optional), and 4) scope, (optional)

Note:

When creating an authentication record, you can specify either a Form record (used for web application authentication) or an OAuth2 record (used for the Swagger/Open API file authentication) in the request. While updating an authentication record,

- Send the Form record with type as NONE if you want to set an OAuth2 record instead of a form record.

- Send OAuth2 with grant type as NONE if you want to set a Form record instead of an OAuth2 record.

comments

User-defined comments.