How to use in VerifyAccessToken?

[#1]

In Generate Access token policy,I can set custom attributes as below,

<Attributes> <Attribute name="username" ref="request.formparam.username" display="true"/> </Attributes>

And this attribute is seen in the Accesstoken response.

In Verify Access token policy,there is <Attributes> tag present.Please suggest what is the purpose of this tag.And how to use this tag.I could not get the details from this link.

[ceber]

This is useful for storing information you want to associate with the token. Maybe you want to use this for analytics, pass the information to back end systems after validation, or use it for some logic within the proxy itself.

Documentation on this is available here: http://docs.apigee.com/api-services/content/customizing-access-tokens

[DChiesa]

In the OAuthV2/VerifyAccessToken, you would not use the Attributes element.

Instead, VerifyAccessToken retrieves the custom attributes that you had set when you previously called GenerateAccessToken. The attributes are then available at runtime in context variables.

For example, at the time of GenerateAccessToken, you might call out to an external user profile service, to retrieve information about the user, or the client. You could then store that with the token, and that information would be implicitly retrieved every time your proxy subsequently receives that token and calls VerifyAccessToken.

Furshtay?

[sunandita_dam]

@RK4 : Usage of custom attribute for verify access token is explained in here really well.

Use this element (attributes) to add custom attributes to an access token or authorization code. For example, you may wish to embed a user ID or session identifier in an access token that can be extracted and checked at runtime.

[Amar_Nekkanti]

@RK4 To Access the Customer attributes that are set in the generate access token policy, no need to define those attributes again in the verify access token policy. Once the verify access token policy is executed we can directly access those attributes as a variables with the prefix 'accesstoken.'

For Example, if you set the attribute username in generate access token, then we can access username as accesstoken.username once the generated token is verfied using verify access token policy.

And if you don't want the attributes to displayed in the access token response then set display="false".

<Attributes> <Attribute name="username" ref="request.formparam.username" display="false"/> </Attributes>