Authorization Code ​

Instructions on how to integrate authorization code flow

1. The user clicks Login within the regular web application.
2. Auth0's SDK redirects the user to the Auth0 Authorization Server (/login endpoint).
3. Your Auth0 Authorization Server redirects the user to the login and authorization prompt.
4. The user authenticates using one of the configured login options and may see a consent page listing the permissions Auth0 will give to the regular web application
5. Your Auth0 Authorization Server redirects the user back to the application with an authorization code, which is good for one use.
6. Auth0's SDK sends this code to the Auth0 Authorization Server (/auth/token endpoint) along with the application's Client ID and Client Secret.
7. Your Auth0 Authorization Server verifies the code, Client ID, and Client Secret.
8. Your Auth0 Authorization Server responds with an ID Token and Access Token (and optionally, a Refresh Token).
9. Your application can use the Access Token to call an API to access information about the user.

The API responds with the requested data.

1. Create application
   • Access the Application page
   • Click on the Create button

• Choose Authenticator Type is Authorization Flow
• Enter Redirect Url which is the callback URL after user login success

2. Add user to application
   • On the applications grid, click the edit icon of record where you want to edit the application
   • Click on tab Application Users
   • Click on the Create button

• Input data: First name, Email. Password and Confirm Password
• Click on the Save button

3. Integrated

When user wants to login to the system, it will redirect to page https://stg.token.tci-pf.net/login?clientId=. With clientId is provided when creating application. After user login successfully, ATM will auto redirect URL with code. Example (local development only): http://localhost:8080/callback?code=<AUTHORIZATION_CODE>.

Now that you've acquired an authorization_code and have been granted permission by the user, you can redeem the code for an access_token to the resource. Redeem the code by sending a POST request to the /auth/token endpoint. Example:

Step 1: Call API to login (Refer to this link)

* Api:
  Name: authenticationApp
  Path: /auth
  Method: POST
  Payload:

{
  "loginId": "user@example.com",
  "password": "<PASSWORD>",
  "clientId": "<YOUR_CLIENT_ID>"
}

- loginId: Email of user's application
- password: Password of user's application
- clientId: Get form application

Example:

var axios = require('axios')
var data = JSON.stringify({
  loginId: 'user@example.com',
  password: '<PASSWORD>',
  clientId: '<YOUR_CLIENT_ID>',
})

var config = {
  method: 'post',
  url: 'https://api.stg.token.tci-pf.net/auth',
  headers: {
    'Content-Type': 'application/json',
  },
  data: data,
}

axios(config)
  .then(function (response) {
    console.log(JSON.stringify(response.data))
  })
  .catch(function (error) {
    console.log(error)
  })

Response data:

{
  "redirectUrl": "https://your-callback-url",
  "code": "<AUTHORIZATION_CODE>"
}

Step 2: Call API to generate token (Refer to this link)

* Api:
  Name: genTokenApp
  Path: /auth/token
  Method: POST
  Payload:

{
  "clientId": "<YOUR_CLIENT_ID>",
  "clientSecret": "<YOUR_CLIENT_SECRET>",
  "grant_types": "authorization_code",
  "code": "<AUTHORIZATION_CODE>"
}

- clientId: Get from application
- clientSecret: Get from application
- grant_types: "authorization_code"
- code: Get from step 1

Example:

var axios = require('axios')
var data = JSON.stringify({
  clientId: '<YOUR_CLIENT_ID>',
  clientSecret: '<YOUR_CLIENT_SECRET>',
  grant_types: 'authorization_code',
  code: '<AUTHORIZATION_CODE>',
})

var config = {
  method: 'post',
  url: 'https://api.stg.token.tci-pf.net/auth/token',
  headers: {
    'Content-Type': 'application/json',
  },
  data: data,
}

axios(config)
  .then(function (response) {
    console.log(JSON.stringify(response.data))
  })
  .catch(function (error) {
    console.log(error)
  })

Response data:

{
  "id_token": "",
  "access_token": "",
  "refresh_token": "",
  "exp_access_token": 600 // Time expire access token. 600 seconds
}

4. Refresh the access token

Access tokens are short lived. Refresh them after they expire to continue accessing resources. You can do so by submitting another POST request to the /auth/token endpoint. Provide the refresh_token instead of the code (Refer to this link). Example:

* Api:
  Name: genTokenApp
  Path: /auth/token
  Method: POST
  Payload:

{
  "clientId": "<YOUR_CLIENT_ID>",
  "refresh_token": "",
  "id_token": "",
  "grantType": "refresh_token"
}

-clientId: Get from application
-grant_types: "refresh_token"

After authentication success, ATM will return the access token, refresh token, id token

var axios = require('axios')
var data = JSON.stringify({
  clientId: '<YOUR_CLIENT_ID>',
  refresh_token: '',
  id_token: '',
  grantType: 'refresh_token',
})

var config = {
  method: 'post',
  url: 'https://api.stg.token.tci-pf.net/auth/token',
  headers: {
    'Content-Type': 'application/json',
  },
  data: data,
}

axios(config)
  .then(function (response) {
    console.log(JSON.stringify(response.data))
  })
  .catch(function (error) {
    console.log(error)
  })

Response data:

{
  "id_token": "",
  "access_token": "", // New access token
  "refresh_token": "", // New refresh token
  "exp_access_token": 600 // Time expiration access token is 600 seconds
}

5. How to validate the access token RSA 256

Call API to get the login key (Refer to this link)

  * Api:
    Name: getJWKS
    Path: /auth/.well-known/jwks.json
    Method: GET

Example:

var jwksClient = require('jwks-rsa');
var client = jwksClient({
  jwksUri: 'https://api.stg.token.tci-pf.net/auth/.well-known/jwks.json'
});

```javascript
var jwksClient = require('jwks-rsa')
var client = jwksClient({
  jwksUri: 'https://api.dev.token.tci-pf.net/auth/.well-known/jwks.json',
})

function getKey(header, callback) {
  client.getSigningKey(header.kid, function (err, key) {
    var signingKey = key.publicKey || key.rsaPublicKey
    callback(null, signingKey)
  })
}

jwt.verify(token, getKey, options, function (err, decoded) {
  console.log(decoded)
})

Decoded token:

{
  "iat": 1662607837,
  "iss": "atm",
  "exp": 1662608437,
  "aud": "<CLIENT_AUDIENCE>",
  "scope": {
    "email": "user@example.com",
    "id": "<USER_ID>",
    "firstName": "Hao app user",
    "lastName": ""
  }
}