Authorization Request

Get a user login

The Authorization Request is described in OAuth2 RFC6749 section 4.1.

This request message contains the following fields.

• response_type. Value MUST be set to "code".
• client_id, use the $app_session ID
• redirect_uri: not used, because the Service definition knows where to redirect to
• scope: might be used in the future, to specify sub-Service access
• state: should be used by the application for security reasons

The endpoint is $login from the application login (the URL found in field $session->{endpoints}{user_login})

The request looks like this:

  GET $login(path)?response_type=code&client_id=$app_session&state=$yourref HTTP/1.1
  Host: $login(host)

A positive response will go to the $endpoint URL configured in the Service definition in Open Console.

  HTTP/1.1 302 Found
  Location: $endpoint?code=$grant&state=$yourref

Relate the received $grant with $yourref. Probably, put the $grant code in the visitor's cookie.

Refresh the user login

On any moment, the Application can require the visitor to upgrade its Grant to a newer version. This will happen when the Grant has expired, but may also happen when the Application expects that the Contract data has changed.

The Authorization Refresh is described in OAuth2 RFC6749 section 6.