REST API
Security Architecture
OpenID flow
Rendering diagram...
Request filters
The first path that matches is the final authentication result. Any security module may throw exceptions that bypass this behavior, for example BadRequestException, RedirectException or UnauthorizedException.
GET | POST | PUT | DELETE /**
Arguments
| Name | Type | Is Required | Default Value |
|---|---|---|---|
| apiKey | Parameter | No | |
| X-API-Key | Header | No |
Given
- A valid hash of an API key.
- A user can be impersonated using the API key.
When
- The route is accessed.
Then
- Returns a WebSecurityAndToken with a private token that can impersonate the API key owner.
GET /oauth/${providerName}
Arguments
| Name | Type | Is Required | Default Value |
|---|---|---|---|
| state | Parameter | Yes | |
| code | Parameter | Yes |
Action
- If the state is valid it will obtain the
auth tokenusing the specifiedcodeand then redirect the user to theredirectUrlspecified in the state parameter. The obtained token is registered with the web token service. - If the
stateorcodeare invalid it will throw aBadRequestException.
GET | POST | PUT | DELETE /**
| Name | Type | Is Required | Default Value |
|---|---|---|---|
| auth.strategy | Cookie | Yes | |
| auth._refresh_token.${providerName} | Cookie | Yes |
Given
- A provider that can handle the required strategy exists.
- The refresh token can be used to obtain a valid web token.
When
- The route is accessed.
Then
- The new token is obtained and registered with the web token service.
- Returns a WebSecurityAndToken.
GET | POST | PUT | DELETE /**
| Name | Type | Is Required | Default Value |
|---|---|---|---|
| one.erp.rest.auth.token | Cookie | Yes | |
| one.erp.rest.locale | Cookie | No | RO |
Given
- A token that the web token service recognizes.
When
- The route is accessed.
Then
- The token can be refreshed if necessary.
- The token can be validated against the security service.
- Returns a WebSecurityAndToken.