This video demonstrates how to create a “Hybrid Client” in the OCS Portal.
The “Hybrid Client” type is appropriate for applications that require access to OCS
for extended periods of time, typically, a PI Server. User interaction is required for
initial browser-based authentication only.
After a user successfully authenticates, the application accesses OCS on their behalf for
extended periods of time through a secure connection without a browser. The application
extends access time to OCS with refresh tokens each time the current token expires. This
is a key feature of the “Hybrid Client” type.
On the OCS Portal home page, click here to display the menu.
Under Security, click Clients.
On the Manage Clients page, select Hybrid from the Client Type list.
Click Add Client to display the Add Client window.
Here, you will define key information required for the Hybrid flow.
Give your “Hybrid Client” a name.
Select Allow Refresh Token to enable refresh tokens. This allows the application to silently
retrieve an access token without requiring user interaction. Refresh Tokens provide continuous
access to OCS for extended periods of time after the initial user authentication.
In the Redirect URL field, enter the URL to which the OCS identity provider sends the
access token it generates for an authenticated user.
Click the + sign to commit your entry.
In the Logout Redirect URL field, provide the URL of the page to which users will be
redirected after they log out from the OCS identity provider.
Click the + sign to commit your entry.
The “Token Lifetime” determines how long the token remains functional each time OCS generates it.
OCS expresses access token expiration time in seconds. You can specify values between
60 and 3600 seconds. Once you have added a value, click “Continue.”
The “Add Secret” window allows you to assign an authentication key for the client.
Enter a description for the secret. It is possible to create many secrets for different
services. As a best practice, include service and expiration details in the description.
Select an expiration date and time in the “Expiration Date” field. OSIsoft recommends
that you set an expiration date and time for the secret and create new secrets as needed.
The Never Expires option keeps the secret active indefinitely, but for security considerations,
OSIsoft discourages using this option.
Please note, the “Token Lifetime” does not affect the “Client Secret” expiration.
An application uses a secret to verify itself against OCS and to retrieve an access
token on behalf of a user. An access token is retrieved when a user successfully completes
the authentication flow against OCS.
When you are finished, click Add.
This screen displays your “Client ID” and “Client Secret.” For security purposes,
OCS does not store any “Client Secret” values and the “Client Secret” is only
visible when you create it. For this reason, you should save the “Client Secret” and
“Client ID” since you will need them later to authenticate users with OCS. Click “Copy”
for each and reference them in the code for your application.
The Client ID and Client Secret referenced by your application must exactly match the
Client ID and Client Secret generated for the Hybrid Client so OCS can authenticate
users.
Please note, security best practices recommend creating a separate client for any additional
application.
When you are finished, click “Close.”