52 docs tagged with "oauth2"

What is Account Linking?

OAuth2/OIDC application types (client_type values), recommended flows, and configuration availability by type in cidaas.

cidaas is an OAuth 2.0 and OpenID Connect authorization server — authorization server basics, standard grants, tokens, and how to secure your apps.

The Authorization Code Flow is one of the OAuth2 flows that was designed to securely authenticate a user and issue an access token. The basic concept behind the authorization code flow is that a code is issued after identification and this must be exchanged for an access token.

AuthZEN permission management in cidaas — policy-based authorization, evaluation, and fine-grained access control.

Step-by-step AuthZEN search — catalog setup, filter vs evaluation policies, SearchConfig, live search APIs, post-evaluation, and troubleshooting.

Live vs simulation AuthZEN channels — version pins, simulation evaluation and search, cache, explain, and a safe rollout path.

The Client Credentials Grant is a type of OAuth 2.0 flow that allows a client application to request access tokens directly from an authorization server by using its own credentials. This flow is specifically designed for Machine-to-Machine (M2M) authentication scenarios where no user interaction is required.

Learn how to rotate client secrets and signing keys securely in cidaas using the App Configuration API.

Encrypt sensitive fields (password, pass_code) on authentication, enrolment, and password APIs when client-side encryption (CSE) is enabled for a verification method.

Communication providers in cidaas — send notifications for user creation, password reset or MFA using built-in or custom providers.

Consent management in cidaas — a GDPR-compliant system at identity level, with consent tracking, webhooks and user activity records.

Consents and consent groups in cidaas — straightforward organisation of consents in groups and versioning.

Learn how to create users in cidaas with admin-set passwords, including role requirements, API integration, user flow, and webhook events.

Protect cidaas integrations against CSRF and replay attacks — how the OAuth 2.0 state and OIDC nonce parameters work and how to implement them.

The Device Code Flow (officially: OAuth 2.0 Device Authorization Grant) is an OAuth 2.0 grant type designed for devices that don't have a browser or have limited input capabilities, such as smart TVs, gaming consoles, CLI tools, or IoT devices. It enables users to authorize these devices to access their resources by authenticating on a separate device (e.g., smartphone or computer) with a full browser.

When a user logs out of your application, you need to properly end their session with cidaas to ensure they're logged out from all applications using the same cidaas instance. This guide explains how to implement logout using OpenID Connect specifications.

Authenticate with FIDO2 in cidaas — let users sign in with FIDO2 compliant Keys, or via passkeys or platform authenticators.

Group selection in cidaas — let users pick the group or context they log in with, enforce the selection, or auto-select one using the group_hint parameter.

Manage hosted page groups, themes, and translations in cidaas, including configuration, customization options, and API references.

Identity providers in cidaas — connect SAML, OAuth 2.0, OpenID Connect, and LDAP/AD for enterprise and social SSO.

CIBA (Client-Initiated Backchannel Authentication), also known as Transactional Authentication, is a modern OAuth 2.0 authentication flow that enables secure, device-to-device authentication. It allows users to authenticate on one device (like their mobile phone) while logging into an application on a completely different device (like a Smart TV, kiosk, or terminal).

Integrating cidaas with your business is simple and can be done for the Admin and User Service portals.

Learn how to invite users in cidaas, including email templates, invitation states, API integration, and the complete invitation flow.

cidaas supports LDAP (Lightweight Directory Access Protocol) and Active Directory for authentication and user synchronization. You can configure cidaas to act as an Identity Provider (IdP) or as a Service Provider (SP).

Authenticate with a magic link in cidaas — a passwordless sign-in link sent to the user, including the APIs for the login flow.

OAuth 2.0 flows in cidaas — Authorization Code, PKCE, client credentials, device code, PAR, and token exchange.

cidaas supports OAuth2 and OpenID Connect (OIDC) for Single Sign-On (SSO) authentication. You can configure cidaas to act as an Identity Provider (IdP) or as a Service Provider (SP).

cidaas provides a set of hashing algorithms out of the box, and we continuously add the latest algorithms, and migrate the user passwords on the fly to a more secure hashing method.

Authenticate with a pattern in cidaas — the user traces a pattern that is verified as a passwordless factor, with the flow and APIs.

Permission management in cidaas — scopes, roles, groups, group/role restrictions, AuthZEN, and group selection, configured in Trustdesk.

The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is an extension of the Authorization Code Flow. It is specifically designed to authenticate native or mobile application users, but is recommended for all scenarios where user authentication is required, especially for public clients that cannot securely store a client_secret.

This document describes a 3-step authentication verification flow using OpenAPI specifications.

Implementing the Pushed Authorization Request (PAR) Flow

Remote Fields is an advanced feature in cidaas that allows field values to be dynamically fetched from an external API during token generation or user profile retrieval.

Configure cidaas as a SAML 2.0 Identity Provider — register an external SP with the SAML_SP app type in Trustdesk.

Scope consent in cidaas — pause the authentication flow to obtain explicit user authorization for scopes such as email or profile.

Learn how scopes work in OAuth2/OIDC and how to configure and manage scopes and scope groups in cidaas.

Session management lets users stay signed in across applications and devices. This guide explains how sessions relate to OAuth 2.0 and OpenID Connect in cidaas, and points you to the right flows for validation, logout, and native-to-web handoff.

Native applications (for example mobile apps) often open company-owned web applications in the system browser: centralized profiles, webshops, help portals, and similar. Those sites typically expect an active IdP session in the browser—the same kind of session that powers Single Sign-On (SSO) for pure web apps—not only a token inside the native app.

Authenticate with Smart Push in cidaas — the user picks the matching number from four shown in the mobile app to confirm the login.

Integrating Social Login in cidaas

The OAuth 2.0 Token Exchange (RFC 8693) is a standardized flow that allows a client to exchange one token for another. This is distinct from the standard OAuth authorization code or client credentials flows and is particularly useful in microservices architectures, token delegation scenarios, and when you need to transform tokens for different contexts.

Authenticate with TOTP in cidaas — verify the time-based one-time password from an authenticator app as a passwordless or MFA factor.

Authenticate with Touch ID in cidaas — use the phone's device biometrics as a passwordless or MFA factor, with the flow and APIs.

Configure what information users provide during registration and how it's stored.

Configure registration and login field profiles in cidaas (User Setup), link them to applications via user_setup_id, and manage profiles through Trustdesk or the User Setup API.

Validate cidaas tokens — check authenticity, expiry and audience of access, ID and refresh tokens, with a practical validation checklist.

Configure Verification Options profiles in cidaas (MFA / step-up enforcement, allowed methods, password policy, suggest verification), link them to applications via verification_options_id, and manage profiles through Trustdesk or the Verification Options API.

Domain- and user-based redirection in cidaas — use webfinger to send users straight to their own identity provider, bring-your-own-identity style.

Webhooks let your systems react to what happens in cidaas the moment it happens. When an event such as ACCOUNTCREATED, LOGIN, or ACCOUNTMODIFIED occurs, cidaas calls your endpoint asynchronously so you can trigger business actions — not just technical ones — in real time.

After an authentication, cidaas approves the correctness of provided information with a token. OAuth2 and OpenID Connect work with different tokens. Either way, cidaas will provide an access token based on OAuth2 standard. The token is built up as a JWT (JSON Web Token), which is essentially a base64-encoded JSON format. Optionally, in a user authentication, cidaas can also provide an ID token, which is based on OIDC standard and also built up as a JWT.