Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 12 Next »

DRAFT

Overview

Today, Admin App supports only forms-based authentication for using the application.  This design proposes adding another method of delegating user-authentication to trusted 3rd party-sources via OpenID Connect, to provide single-sign on like experiences to users of Ed-Fi tools.  If this design, implemented code and pattern is successful in Admin App, it will be considered for reuse in applications such as Data Import.

Registering client application with external authentication providers:

Client application needs to be registered to an external authentication provider, in order to delegate the user authentication process.

The client application registration varies across different providers.

Ex: Steps for registering Admin App to Google authentication provider API: 

  1. Register Admin App with Google at https://console.developers.google.com
  2. Set the redirect URI to https://localhost:5000/signin-google (localhost:5000 will be replaced with Admin App host and port)
  3. User can get Client Key and Client Secret by setting up Credentials details on Google API
  4. User will be using the given Client Key and Client Secret on Admin App to establish the connection with Google API for authenticating the user

Note: Similarly, Admin App should be registered with custom OIDC authentication provider for availing client_key and client_secret.

OIDC authentication flow on Admin App:

Login flow:

If OIDC authentication enabled on Admin App! on Login page user will find form authentication controls as well as link/ button to OIDC authentication.

If user chooses to go with OIDC method, then user will be taken to third party confirmation page for signing in.

Upon successful sign in, session cookie will be set, and user will be navigated/ redirected to Admin App page. 

Registering external user on Admin App:

Registering external user on Admin App will make sure that user info, claims from external provider and

Admin App specific role details are getting added to Admin App authentication tables for future reference. 

Log out:

On Admin App, the cookie is used as default sign-in and sign-out schema. So, logout operation will clear the cookie.






  • No labels