Introduction#
OAuth is an open standard to authorization. OAuth provides client applications a ‘secure delegated access’ to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials.A technical specification of OAuth 2.0 is described in the standard RFC 6749. A non-technical simple specification is given in this guide and Wikipedia.Authorization endpoint#
This endpoint ensures that the user is logged in and has authorized access to the desired resource. It returns an authorization code as per the OAuth specification. If the user is not already logged in, she will be presented with the same GUI as the loginUrl.Authorization grant types#
We are supporting two types of Authorization grant types:Client credentials (used for client API).
Authorization code#
The authorization token is provided by the authorization endpoint and is used with the token endpoint to get an access token.Token endpoint#
The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token. The token endpoint is used with every authorization grant except for the implicit grant type (since an access token is issued directly). See the OAuth specification.Access token#
The access token is provided by the token endpoint and is required in order to access the ConnectID APIs.
Access token lifetime is 12 hours by default but may be overridden in the client configuration if necessary.Refresh token#
Refresh token is a token that the Oauth client can use to get a new access token without the user's interaction.
Refresh token lifetime is 30 days by default.Extension grant types#
The OAuth2 specification allows for extension grant types to be created (see section 4.5 in RFC 6749). Unite has created a proprietary grant type to enable the token endpoint to issue tokens using the state code given by the External Identity. In order to use the custom grant type the client must POST to the token endpoint using the following parameters (for External Identity API):extidCode is an JWT token that contains user information required to process OAuth alternate login flow. This JWT token has a default lifetime for 20 minutes.
The request should be sent as application/x-www-form-urlencoded and authenticated using Basic Authentication. The response is a standard OAuth2 response according to the specifications in RFC 6749.URLs for OAuth 2.0#
Below you find the URLs that you need to use OAuth 2.0 and these are based on the Norwegian domain .no.Production#
If you wish to use the Swedish domain, please use .se instead of .no in production environment.
Test#
