Which features are supported in the OAulhV2 policy'? Select all that are correct. Choose 3 answers

The Apigee OAuthV2 policy is a versatile tool for implementing OAuth 2.0 authorization. It directly supports adding custom metadata to tokens using the element, which can be used by other policies. The policy also accommodates integrations with external identity providers by allowing the storage and management of externally generated tokens via the element. Furthermore, it provides granular control over token lifecycles, enabling the configuration of different expiration times for access tokens and refresh tokens through the and elements respectively. This is a common security practice to limit the exposure of short-lived access tokens while allowing for longer-lived refresh tokens.

C. credentials validation when password granttype is used: The OAuthV2 policy does not perform user credential validation. For the password grant type, validation must be explicitly handled by another policy (e.g., ServiceCallout) before the OAuthV2 policy executes.

1. Google Cloud

Apigee Documentation

"OAuthV2 policy": This document details the configuration elements of the policy.

For Answer A: Under the section "GenerateAccessToken > Attributes"

it states: "Use this element to add custom attributes to an access token... For example

you may want to embed a user ID or a session identifier in an access token."

For Answer B: Under the section "GenerateAccessToken > ExternalAccessToken"

it explains: "If you want to use an external token store... use this element to specify the external access token. The policy will skip the step of generating and storing an access token in the Apigee token store."

For Answer D: Under the section "GenerateAccessToken"

the elements and are described

allowing for separate time-to-live values for each token type.

For Incorrect Option C: Under the section "Flow variables"

in the note about the password grant type

it explicitly states: "Unlike other grant types

the Apigee policy does not validate the user's credentials. It is the responsibility of the API proxy developer to create a policy that takes the user's credentials and validates them against an identity store..."