35 docs tagged with "scope-management"

Digital pass and ticket management in cidaas — concepts, use cases, and API reference for passes, templates, and layouts.

Authorize service-to-service and partner API access with Access Pass Personal Access Tokens (PAT) instead of JWTs.

Manage OAuth2/OIDC applications and clients in cidaas, including app settings, advanced configuration, and API references.

General

cidaas provides fine-grained authorization beyond OAuth2 scopes and group/role restrictions through the OpenID AuthZEN standard. AuthZEN separates policy administration from policy decision and supports attribute-based policies (Rego/OPA), external data via Policy Information Points (PIP), and Relationship-Based Access Control (ReBAC).

Audit configuration changes in cidaas with who changed what, when, and the previous and new values.

Precheck

The Client Credentials Grant is a type of OAuth 2.0 flow that allows a client application to request access tokens directly from an authorization server by using its own credentials. This flow is specifically designed for Machine-to-Machine (M2M) authentication scenarios where no user interaction is required.

Learn how to rotate client secrets and signing keys securely in cidaas using the App Configuration API.

Precheck

Overview

Overview

Benefits

Group Role Restriction in cidaas — control who can log in by verifying group membership and roles, embed hints in the JWT, and validate access at runtime.

cidaas provides a comprehensive set of webhook events that you can subscribe to for real-time notifications about various activities in your system.

Permission management in cidaas — scopes, roles, groups, group/role restrictions, AuthZEN, and group selection, configured in Trustdesk.

The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is an extension of the Authorization Code Flow. It is specifically designed to authenticate native or mobile application users, but is recommended for all scenarios where user authentication is required, especially for public clients that cannot securely store a client_secret.

This document describes a 3-step authentication verification flow using OpenAPI specifications.

cidaas lets you get data from your customers each time they interact with your product instead of requesting their profile information all at once during registration.

Implementing the Pushed Authorization Request (PAR) Flow

cidaas ReBAC uses Relation Store to store authorization graphs: object types, relations, permissions, and relationship tuples.

Hosted page

Remote Fields is an advanced feature in cidaas that allows field values to be dynamically fetched from an external API during token generation or user profile retrieval.

Configure cidaas as a SAML 2.0 Identity Provider for an external Service Provider using the SAML_SP application type and the Trust Desk creation wizard.

Precheck

Learn how scopes work in OAuth2/OIDC and how to configure and manage scopes and scope groups in cidaas.

The OAuth 2.0 Token Exchange (RFC 8693) is a standardized flow that allows a client to exchange one token for another. This is distinct from the standard OAuth authorization code or client credentials flows and is particularly useful in microservices architectures, token delegation scenarios, and when you need to transform tokens for different contexts.

Hosted pages

Learn how to update user profile information in cidaas, including field permissions, instant email/mobile changes, and API usage.

Configure what information users provide during registration and how it's stored.

Automatically send verification reminders and manage user accounts based on verification status.

Configure registration and login field profiles in cidaas (User Setup), link them to applications via user_setup_id, and manage profiles through Trustdesk or the User Setup API.

Learn how to manage user status in cidaas, including status values, transitions, API usage, email templates, and webhooks.

Webhooks let your systems react to what happens in cidaas the moment it happens. When an event such as ACCOUNTCREATED, LOGIN, or ACCOUNTMODIFIED occurs, cidaas calls your endpoint asynchronously so you can trigger business actions — not just technical ones — in real time.

Today's competitive landscape calls for better security implementation for user accounts. With customers becoming more demanding and applications becoming critical, a seasoned and reliable CIMS helps manage both optimally.