kong

Rolling claims builder, which uses short-lived tokens to perform authorization.

Kong uses 3 services to complete Client and User authentication;

Security (Profile & Client Authentication)

Manager (User Authentication & Registration)

Authority (UI Client which delegates calls to Security & Entity Services)

Typical Application Flow (Web Client)

Request Token
IF Requires User, Authenticate
Introspect / Call Resource

Request Token

Clients must request a token before calling a resource

Verify that Client exists
Verify Client secret
Validate requested Scopes against the client's allowed scopes
When User is required, Validate UserToken
Assign consented claims provided by requested Scopes
Encrypt Token