Which features are supported in the OAuthV2 policy? Choose 3 answers

The Apigee OAuthV2 policy is a versatile tool for implementing OAuth 2.0 flows. It directly supports storing an external (third-party) access token by using the element within the GenerateAccessToken operation. This is useful when Apigee acts as an intermediary. The policy also allows developers to embed custom key-value pairs into the token's metadata using the element, which can be used for fine-grained authorization or analytics. Furthermore, it provides granular control over token lifecycles, enabling the configuration of different expiration times for access tokens and refresh tokens via the and elements, respectively. This is a standard security practice to limit the exposure of short-lived access tokens.

C. Credentials validation when password granttype is used: The OAuthV2 policy does not validate end-user credentials (username/password). This validation must be performed by the API developer using a separate policy before the token generation step.

E. Validation of external refresh tokens: The RefreshAccessToken operation within the policy is designed to work only with refresh tokens that were originally generated and stored by Apigee. It does not have a built-in mechanism to validate external refresh tokens.

1. Storing external access tokens (A)

Setting custom attributes (B)

Setting different expiration (D):

Source: Google Cloud Apigee Documentation

"OAuthV2 policy".

Reference: Under the section "GenerateAccessToken operation"

the documentation details the child elements:

: "When you need to store a third-party access token

use this element."

: "Use to add custom attributes to an access token."

and : These elements are listed and described

allowing for separate time-to-live values for each token type.

2. Credentials validation (C):

Source: Google Cloud Apigee Documentation

"Implementing the password grant type".

Reference: In the "About the password grant type" section

it explicitly states: "The OAuthV2 policy will validate the clientid and clientsecret

but it is up to you to validate the end user's username and password."

3. Validation of external refresh tokens (E):

Source: Google Cloud Apigee Documentation

"OAuthV2 policy".

Reference: The documentation for the RefreshAccessToken operation shows no element or attribute for handling or validating an external refresh token. The process described relies on looking up the provided refresh token in Apigee's internal token store.