Authenticating users
At Stonal, we use a dedicated service for identity management.
We support only the OpenID Connect (OIDC) protocol for authentication.
Need an API access token instead? See Authentication.
Federating a customer's own SSO? See Set up identity delegation.
Authentication
Workflow
We use authorization_code grant type flow for OIDC authentication.
Description
All Stonal APIs are protected by authentication and authorization mechanisms.
By default, our platform frontend fetches the user connected authorization through an internal API Gateway. The API Gateway is responsible for checking if current user is connected via a secured cookie.
Depending on whether the user is connected, the API Gateway will use the access and refresh tokens (JWT tokens) stored alongside with the cookie in a private data store to fetch the user connected authorizations and access Stonal private APIs.
If the user is not connected, the API Gateway will redirect the user to our SSO service to authenticate. When authenticated, our SSO service will redirect the user back to the API Gateway with an authorization code which will be exchanged for an access token and a refresh token associated with the user and stored in the private data store alongside with the cookie.
Be aware, users account need to be created before users can authenticate through the SSO.
Go to Managing users for more information.