Enabling API Access for Omnissa Identity Service

You can enable API access for Omnissa Identity Service after setting up the initial integration with your identity provider from the Omnissa Connect console. Use the APIs to manage user and group, identity federation, and administration operations programmatically.

To enable API access, you need to create an OAuth 2.0 Client for Omnissa Identity Service in Omnissa Connect.

First, to obtain an admin token for initial access, create a temporary OAuth 2.0 Client from the Omnissa Identity Service page in the Omnissa Connect console. Then use the client credentials to call the REST APIs to create another OAuth 2.0 client with limited privileges, which you will continue to use with the Omnissa Identity Service APIs. After creating the second client, delete the temporary client.

Prerequisites

• You have the following roles:
  • Organization Administrator and Organization Owner roles in Omnissa Connect (for Omnissa Identity Service cloud service only)
  • Super Admin role in the Omnissa Access service
  • Administrator roles in the services you integrate with Omnissa Identity Service. For Workspace ONE UEM, the Console Administrator role or an equivalent custom role is required.
• From the Identity Management > End User Management page in the Omnissa Connect console, you have enabled Omnissa Identity Service, configured the integration with your third-party identity provider, and selected the Omnissa products and services to use with the identity provider.

Procedure

1. Create a temporary OAuth 2.0 Client in the Omnissa Connect console.

   1. Navigate to Omnissa Identity Service.

      • Cloud: Log in to the Omnissa Connect console, select Identity Management > End User Management from the left pane, then click Launch End User Management.
      • On premises: Log in to the Omnissa Access console, select Integrations > Identity Service, then click Configure SCIM Provisioning.

      Omnissa Identity Service opens in a new tab in the browser.

   2. Click the API Credentials button.

   3. On the API Credentials page, click Add Client.

      An OAuth 2.0 client named api-bootstrap-client is generated.

   4. Copy the Client ID and Shared Secret values.

      Important: Make sure that you copy the secret before leaving the page, otherwise you will have to regenerate it. To regenerate the secret, click the Regenerate button. Be aware that when you regenerate the secret, the previous secret is immediately invalidated.

      

2. Get an access token using the Client ID and Shared Secret values of the temporary client.

   See Step 2: Get access token for the OAuth 2.0 Client in the Getting Started with Omnissa Identity Service REST APIs section of the Omnissa Identity Service API Reference.

3. Use the REST APIs to create another OAuth 2.0 Client, with the IDP_AND_DIRECTORY_ADMIN rule set.

   See Step 3: Create OAuth 2.0 Client with Identity Provider and Directory Admin Ruleset in the Getting Started with Omnissa Identity Service REST APIs section of the Omnissa Identity Service API Reference.

4. In the Omnissa Connect console, delete the temporary OAuth 2.0 client named api-bootstrap-client.

   1. Navigate to Omnissa Identity Service.

      • Cloud: Log in to the Omnissa Connect console, select Identity Management > End User Management from the left pane, then click Launch End User Management.
      • On premises: Log in to the Omnissa Access console, select Integrations > Identity Service, then click Configure SCIM Provisioning.

      Omnissa Identity Service opens in a new tab in the browser.

   2. Click the API Credentials button.

   3. On the API Credentials page, click Delete to delete the api-bootstrap-client client.

What to do next

Use the Omnissa Identity Service REST APIs to manage user and group, identity federation, and administration operations. To call the APIs, obtain an access token from the second OAuth 2.0 Client that you created.

For information about using the Omnissa Identity Service REST APIs, see the API Reference.