51 docs tagged with "oauth2"

What is Account Linking?

OAuth2/OIDC application types (client_type values), recommended flows, and configuration availability by type in cidaas.

General

The Authorization Code Flow is one of the OAuth2 flows that was designed to securely authenticate a user and issue an access token. The basic concept behind the authorization code flow is that a code is issued after identification and this must be exchanged for an access token.

cidaas provides fine-grained authorization beyond OAuth2 scopes and group/role restrictions through the OpenID AuthZEN standard. AuthZEN separates policy administration from policy decision and supports attribute-based policies (Rego/OPA), external data via Policy Information Points (PIP), and Relationship-Based Access Control (ReBAC).

Step-by-step AuthZEN search — catalog setup, filter vs evaluation policies, SearchConfig, live search APIs, post-evaluation, and troubleshooting.

Live vs simulation AuthZEN channels — version pins, simulation evaluation and search, cache, explain, and a safe rollout path.

The Client Credentials Grant is a type of OAuth 2.0 flow that allows a client application to request access tokens directly from an authorization server by using its own credentials. This flow is specifically designed for Machine-to-Machine (M2M) authentication scenarios where no user interaction is required.

Learn how to rotate client secrets and signing keys securely in cidaas using the App Configuration API.

Overview

Overview

Overview

Learn how to create users in cidaas with admin-set passwords, including role requirements, API integration, user flow, and webhook events.

Benefits

The Device Code Flow (officially: OAuth 2.0 Device Authorization Grant) is an OAuth 2.0 grant type designed for devices that don't have a browser or have limited input capabilities, such as smart TVs, gaming consoles, CLI tools, or IoT devices. It enables users to authorize these devices to access their resources by authenticating on a separate device (e.g., smartphone or computer) with a full browser.

When a user logs out of your application, you need to properly end their session with cidaas to ensure they're logged out from all applications using the same cidaas instance. This guide explains how to implement logout using OpenID Connect specifications.

Passwordless

Login precheck

Manage hosted page groups, themes, and translations in cidaas, including configuration, customization options, and API references.

CIBA (Client-Initiated Backchannel Authentication), also known as Transactional Authentication, is a modern OAuth 2.0 authentication flow that enables secure, device-to-device authentication. It allows users to authenticate on one device (like their mobile phone) while logging into an application on a completely different device (like a Smart TV, kiosk, or terminal).

cidaas allows the integration of third-party Identity Providers (IDP).

Integrating cidaas with your business is simple and can be done for the Admin and User Service portals.

Learn how to invite users in cidaas, including email templates, invitation states, API integration, and the complete invitation flow.

cidaas supports LDAP (Lightweight Directory Access Protocol) and Active Directory for authentication and user synchronization. You can configure cidaas to act as an Identity Provider (IdP) or as a Service Provider (SP).

Passwordless

cidaas leverages a variety of world-class authentication flows to ensure the utmost safety and security of your information. Below is an overview of the OAuth flows available in cidaas, with detailed comparisons to help you choose the right flow for your use case.

cidaas supports OAuth2 and OpenID Connect (OIDC) for Single Sign-On (SSO) authentication. You can configure cidaas to act as an Identity Provider (IdP) or as a Service Provider (SP).

cidaas provides a set of hashing algorithms out of the box, and we continuously add the latest algorithms, and migrate the user passwords on the fly to a more secure hashing method.

Passwordless

Permission management in cidaas — scopes, roles, groups, group/role restrictions, AuthZEN, and group selection, configured in Trustdesk.

The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is an extension of the Authorization Code Flow. It is specifically designed to authenticate native or mobile application users, but is recommended for all scenarios where user authentication is required, especially for public clients that cannot securely store a client_secret.

This document describes a 3-step authentication verification flow using OpenAPI specifications.

Passwordless

Implementing the Pushed Authorization Request (PAR) Flow

Remote Fields is an advanced feature in cidaas that allows field values to be dynamically fetched from an external API during token generation or user profile retrieval.

Configure cidaas as a SAML 2.0 Identity Provider for an external Service Provider using the SAML_SP application type and the Trust Desk creation wizard.

Precheck

Learn how scopes work in OAuth2/OIDC and how to configure and manage scopes and scope groups in cidaas.

Session management lets users stay signed in across applications and devices. This guide explains how sessions relate to OAuth 2.0 and OpenID Connect in cidaas, and points you to the right flows for validation, logout, and native-to-web handoff.

Native applications (for example mobile apps) often open company-owned web applications in the system browser: centralized profiles, webshops, help portals, and similar. Those sites typically expect an active IdP session in the browser—the same kind of session that powers Single Sign-On (SSO) for pure web apps—not only a token inside the native app.

Integrating Social Login in cidaas

The OAuth 2.0 Token Exchange (RFC 8693) is a standardized flow that allows a client to exchange one token for another. This is distinct from the standard OAuth authorization code or client credentials flows and is particularly useful in microservices architectures, token delegation scenarios, and when you need to transform tokens for different contexts.

Passwordless

Passwordless

Configure what information users provide during registration and how it's stored.

Configure registration and login field profiles in cidaas (User Setup), link them to applications via user_setup_id, and manage profiles through Trustdesk or the User Setup API.

Overview

Configure Verification Options profiles in cidaas (MFA / step-up enforcement, allowed methods, password policy, suggest verification), link them to applications via verification_options_id, and manage profiles through Trustdesk or the Verification Options API.

webfinger

Webhooks let your systems react to what happens in cidaas the moment it happens. When an event such as ACCOUNTCREATED, LOGIN, or ACCOUNTMODIFIED occurs, cidaas calls your endpoint asynchronously so you can trigger business actions — not just technical ones — in real time.

After an authentication, cidaas approves the correctness of provided information with a token. OAuth2 and OpenID Connect work with different tokens. Either way, cidaas will provide an access token based on OAuth2 standard. The token is built up as a JWT (JSON Web Token), which is essentially a base64-encoded JSON format. Optionally, in a user authentication, cidaas can also provide an ID token, which is based on OIDC standard and also built up as a JWT.