Qodex.ai

Walkthrough: Salto KS login with External Idp

Number of APIs: 3

This collection consists of steps required to obtain an access token through external Identity Provider login.

Use it with Qodex environment variables set called 'IDS Integration Partner guide'.

Prerequisites to populate environment variables:

  1. ClientID/Password pair for Password authentication flow - please request from SaltoKS Support team
    Env variables
    clientwithpasswordid: {{clientwithpasswordid}}
    clientwithpasswordsecret: {{clientwithpasswordsecret}}
  2. ClientID for Authorization code with PKCE authentication flow
    Env variables
    clientwithpkceid: {{clientwithpkceid}} - please request from SaltoKS Support team
    clientwithpkceredirecturi: {{clientwith_pkceredirect_uri}} => please share with SaltoKS support team
  3. Integration partner has a user (self registered or invited to a site) and a Site
    Env variables
    siteid: {{siteid}} - site where you expect a new user to belong
    systemuserusername: {{systemuserusername}} - this user can either be self-registered or invited via SaltoKS Web App
    system_user    password: {{systemuser_password}} - this user can either be self-registered or invited via SaltoKS Web App

So the flow is:

  1. User exists (or created in advance) in Integration Partner’s Identity Provider
  2. Integration Partner creates the User in Connect API. It is a server-to-server call, initiated by Integration Partner’s Backend app. In this Qodex collection it's imitated in Step 1.3
    IMPORTANT: there is no auto provision of users in current implementation. If a user that wasn’t previously created though Step 1.3 and tries to login, an error will be thrown.
  3. User logs into Integration Partner’s Application (Web Front End/Mobile). It is imitated in Step 2.1
  4. Once logged in through Integration Partner's Idp and access token is obtained, it can be reused for Connect API calls until it expires.

  1. Step 1. Create User - 1.2 Get list of roles to choose one for a new user GET {{connect_api_url}}/v1.1/sites/:site_id/roles

  2. Step 1. Create User - 1.1 Get Access Token (server-to-server integration) POST {{identity_server_url}}/connect/token

  3. Step 1. Create User - 1.3 Create User POST {{connect_api_url}}/v1.1/sites/:site_id/users