- SSO : Single Sign On
- IdP : Identity Provider (Azure Ad, Okta, Auth0, JumpCloud, etc ...)
- SP : Service Provider (TreasuryXpress, Outlook.com, Jira.com, etc ...)
- SAML : Security Assertion Markup Language
- ADFS : Active Directory Federation Service
- One Centralized Login
- Easy to add/remove users access
- Easy to enforce aging policy (password lifetime, etc)
- Implementing MFA is done by the IdP
- Dependant on other provider
- Complext to setup
- SAML
- OpenId Connect
- OAuth 1 (not supported)
- OAuth 2
- ADFS (not supported)
- Azure Active Directory
- Okta
- Auth0
- JumpCloud
- OneLogin
- Custom implementation
- and many more ...
We support the Login On Behalf, it's useful when you want to login for multiple real users with the same login. A good example would be, the Support Login wich used heavily within the US team.
+--------+ +---------------+
| |--(A)- Authorization Request ->| Resource |
| | | Owner |
| |<-(B)-- Authorization Grant ---| |
| | +---------------+
| |
| | +---------------+
| |--(C)-- Authorization Grant -->| Authorization |
| Client | | Server |
| |<-(D)----- Access Token -------| |
| | +---------------+
| |
| | +---------------+
| |--(E)----- Access Token ------>| Resource |
| | | Server |
| |<-(F)--- Protected Resource ---| |
+--------+ +---------------+
+--------+ +--------+
| | | |
| |---------(1) AuthN Request-------->| |
| | | |
| | +--------+ | |
| | | | | |
| | | End- |<--(2) AuthN & AuthZ-->| |
| | | User | | |
| RP | | | | OP |
| | +--------+ | |
| | | |
| |<--------(3) AuthN Response--------| |
| | | |
| |---------(4) UserInfo Request----->| |
| | | |
| |<--------(5) UserInfo Response-----| |
| | | |
+--------+ +--------+
+--------+ +---------------+
| |--(A)------- Authorization Grant --------->| |
| | | |
| |<-(B)----------- Access Token -------------| |
| | & Refresh Token | |
| | | |
| | +----------+ | |
| |--(C)---- Access Token ---->| | | |
| | | | | |
| |<-(D)- Protected Resource --| Resource | | Authorization |
| Client | | Server | | Server |
| |--(E)---- Access Token ---->| | | |
| | | | | |
| |<-(F)- Invalid Token Error -| | | |
| | +----------+ | |
| | | |
| |--(G)----------- Refresh Token ----------->| |
| | | |
| |<-(H)----------- Access Token -------------| |
+--------+ & Optional Refresh Token +---------------+