Consumer Sales Portal authentication in InsuranceNow

Consumer Sales Portal authenticates with InsuranceNow using JWT tokens from Okta for secure API access.

The Consumer Sales Portal uses a JWT from Okta to authenticate with InsuranceNow. JWT client authentication requires that the Guidewire Cloud team registers the application with the Guidewire Identity Federation Hub and that InsuranceNow is configured with the required settings and credentials to request and receive a JWT from Okta.

The following steps describe how consumer sales portals authenticate with InsuranceNow:

  1. Portal submits the POST /clients/{clientId}/sessions API endpoint.
  2. InsuranceNow requests an Okta-issued JWT token
  3. The portal includes the Okta-issued JWT token in the API response.
  4. The portal includes the Okta-issued JWT token with each subsequent API request for that session.
  5. InsuranceNow validates the Okta-issued JWT token prior to executing each API request.

Configure InsuranceNow Sales Portal JWT auth

Configure JWT client settings and Okta HTTP client settings to enable Consumer Sales Portal authentication with InsuranceNow.

Before you begin

Contact Guidewire Cloud team to register the application with Guidewire Identity Federation Hub (Guidewire Hub).

About this task

The JWT client settings provides the information used by the client to access the InsuranceNow API. The Okta HTTP client settings provide InsuranceNow the details required to request and decode the Okta-issued JWT.

Procedure

Configure the local JWT client settings
  1. Configure the following parameters in web/APP-INF/mda/jwt/jwt-client-settings.xml to provide details for the JWT token request:
    Parameter Description
    CustomerId Name of the application used within InsuranceNow. For example, ConsumerSalesPortal.
    ClientId Client identifier provided by the Guidewire Cloud team. This ID is used to communicate with Guidewire Hub).
    ClientSecret Client secret provided by the Guidewire Cloud team. This secret provides authorization for the client associated with the ClientId.
    IN_UserName User name associated with the JWT token. In general, the DirectPortal user is used for consumer portal access.
Configure the local Okta HTTP client settings
  1. Configure the following parameters in web/APP-INF/mda/jwt/okta-httpclient-settings.xml:
    Parameter Description
    ClientId Client identifier provided by the Guidewire Cloud team. This information is provided in the application registration response.
    Grant_Type Type of grant. Enter CLIENT_CREDENTIALS.
    Scope Scope associated with the application. For example, inow-consumerportal-api.​consumer.
    AuthServerUri Authorization server to request and decode JWT tokens. This information is provided in the application registration response.
    Content-Type API content type. Enter application/x-www-form-urlencoded.
    JWKUrl Endpoint URL to fetch the public key. The public key is used to decode the JWT token. The format is <AuthServerUri>/v1/keys.
    Issuer URL that identifies the issuer of the token.
Configure deployment-specific settings
  1. For each deployment environment, configure the following parameters in the JWT client section of config.properties:
    Parameter Description
    JWT_CUSTOMER_ID Name of the application used within InsuranceNow. For example, ConsumerSalesPortal.
    JWT_CLIENT_ID Client identifier provided by the Guidewire Cloud team. This ID is used to communicate with Guidewire Hub.
    JWT_CLIENT_SECRET Client secret provided by the Guidewire Cloud team. This secret provides authorization for the client associated with the ClientId.
    JWT_IN_USERNAME User name associated with the JWT token. In general, the DirectPortal user is used for consumer portal access.
  2. For each deployment environment, configure the following parameters in the OKTA client settings section of config.properties:
    Parameter Description
    OKTA_CLIENT_ID Client identifier provided by the Guidewire Cloud team. This information is provided in the application registration response.
    OKTA_GRANT_TYPE OKTA grant type. Enter CLIENT_CREDENTIALS.
    OKTA_SCOPE Scope associated with the application. For example, inow-consumerportal-api.​consumer.
    OKTA_AUTH_SERVER_URI Authorization server to request and decode JWT tokens. This information is provided in the application registration response.
    OKTA_CONTENT_TYPE API content type. Enter application/x-www-form-urlencoded.
    OKTA_JWK_URL Endpoint URL to fetch the public key. The public key is used to decode the JWT token. The format is <AuthServerUri>/v1/keys.
    OKTA_ISSUER URL that identifies the issuer of the token.