Level 2 Service Education DRAFT

[zsamji]

To follow up on our Level 1 Service Education, we want to equip you with the information needed to get a sample app up and running on your end

Level 1 Link

Tokens
A Token is the strange lengthy string provided by the authentication server, which is actually used for authentication Reference. The frequently used ones are:

• ID Token

  • ID tokens are issued by the authorization server and contain claims that carry information about the user. They can be sent alongside or instead of an access token. Information in ID Tokens allows the client to verify that a user is who they claim to be. Reference

• Access Token

  • An access token is a tiny piece of code that contains a large amount of data. Information about the user, permissions, groups, and timeframes is embedded within one token that passes from a server to a user's device. Plenty of websites use access tokens. Reference

• What's the difference ID Token and Access Token

• Refresh Token

  • A refresh token is a special key that enables a client for an API or service to retrieve new access tokens without requiring the user to perform a complete login. In other words, an application can exchange a valid refresh token for a new access token. Reference

Refresh Tokens: What and when

More on tokens

• What are JSON Web Tokens (JWT), JSON Web Key (JWK), etc

Token Validation - why you care and where you do this

• Where you can validate tokens (front end or back end)
  • JavaScript Object Notation - JSON Web tokens
  • What to check when validating ID token
  • Validating access tokens

What do tokens give you?

• What the tokens give you ie attributes or mappers (specific identity information)
  • Visual Representation
  • Another representation of IDP Attributes & Mappers
  • What do I need, Public or Confidential Client Type?
• Use our Common Hosted Single Sign On (CSS) App to make an integration request:

Examples you can use
- Example Repo

Stay tuned as we create a new discussion thread on Level 3 that dives deeper into other things....

[kurokn]

Great links in defining the different types of tokens, not sure if reader needs to understand all types, but it's good to have them. Token samples are very useful and in a fair level of difficulty in understanding them. Personally feel the token validation part is the hardest one on this level.

[zsamji]

i've just added some terms on tokens - take a peak; i still need to add a definition of payload and and token validation