OAuth Identity Provider

Code On Time release 8.9.42.0 introduces the new OAuth 2.0 Identity Provider as an application framework component. Developers can configure their apps to authorize users with any OAuth 2.0 compatible authorization server such as Google, Microsoft, Facebook, or another Code On Time app. Applications can authorize users through an open source IdP such as Keycloak to take advantage of SAML and OpenID Connect.

Enhance the user experience with the single sign-on for your public and enterprise apps. Multiple instances of OAuth 2.0 identity provider can be registered in the apps’ content management system.

Developers have an option to create a single app that serves as the identity provider for custom applications built using Code On Time or any other development platform. The dedicated identity provider application delivers the Federated Identity Management for your entire application collection. It is easy to link the identity provider application to any number of OAuth 2.0 authorization servers.

If you have experience setting up an API development tool for OAuth 2.0, you will have little trouble setting up your own applications.

Many-To-Many Fields

Another highlight of this release includes various improvements to the SQL statement construction at runtime when the many-to-many fields coexist with fields based on formulas. Access Control Rules and user-defined filters are correctly folded to the appropriate block of the SELECT statements.

Summary

The following features and product enhancements are included in this release:

• (Framework) Filtering of many-to-many fields will not cause an exception when there are formula-based fields that are referencing custom parameters.
• (Touch UI) The client app does not respond to the resize and orientation change events triggered when the initialization has not finished yet. This may happen in the WebKit browsers, when the browser changes the window layout while the document is still being parsed.
• (Framework) Business rule developers have access to the UserClaims JSON object representing the id_token from the identity provider that has authorized the current user.
• (Touch UI) The progress screen message is correctly centered when the app is running in the App Studio mode.
• (OAuth 2) Multiple instances of OAuth 2.0 Identity Provider can be registered for OAuth 2.0 authorization with any compatible IdP.
• (OAuth) Error inspection code makes sure that there is a response in the exception. There will be none if the authorization server is not available.
• (Data Aquarium) The JavaScript expressions specified in Visible When, Read-Only, etc are correctly handling situations when two fields with the same root are being used. For example, the following expressions will not cause the runtime exception anymore:
  
JavaScript

12this.Field1 != null && this.Field1Suffix != null
$row.Field != null && $row.Field1Sufix != null

• (Universal Input) The list-based inputs (radio, listbox) now advance to the next data input when changed if the data field is tagged as lookup-auto-advance.
• (Universal Input) The Up/Down icon of the DropDownList input now has a transparent background for a better presentation when other inputs have a slight overlap and bleed into its boundaries. The "dropdown" icon of the lookup fields in forms have an opaque background in the Property Grid only.
• (OAuth) The /oauth2/v2 endpoint is added to the provider URI of a client app if it is not based on App Identity.
• (CMS) The OAuth2 identity requests are identified in the content description.
• (OAuth) The settings object embedded in the pages now includes the idP key that represents the dictionary of the display names of the identity providers registered in the content management system The "cached" dictionary is refreshed every fifteen minutes.
• (REST) The preferred_username claim is set to the username when the profile scope is requested by the client app during the OAuth 2.0 authorization sequence.
• (CMS) The "Protocol" of an existing identity consumer is read-only when open in the Site Content (app's CMS).
• (Touch UI) Enhanced the algorithm of toolbar menu fade-in effect.

The OAuth 2.0 Authorization tutorial provides instructions on how to configure an OAuth 2.0 identity provider in a Code On Time application. The example uses both the Google Account and the Northwind demo application as the identity providers and a sample application running on localhost as the client. The document includes detailed steps on configuring the identity provider, the client application, and the authorization flow.

The configuration process involves setting up the identity provider's client ID, client secret, redirect URI, and other parameters. The client application is configured to use the identity provider's authorization URI, access token URI, and other endpoints. The authorization flow describes how the user is redirected to the identity provider's login page, signs in, and is redirected back to the client application.

One of the key features of this setup is that users can sign in to the client application using their Google or Northwind account credentials, which are stored securely by the identity provider. This eliminates the need for users to create and manage separate accounts for the client application. Additionally, the document discusses how user tokens are stored persistently in the client application, allowing for seamless authentication and authorization in subsequent requests.

The tutorial provides a comprehensive guide for configuring an OAuth 2.0 identity provider in a Code On Time application, enabling users to leverage a trusted external identity provider for authentication. It highlights the benefits of using an external identity provider for secure and convenient user authentication.

Explore how to set up your application for user authentication using OAuth 2.0 Authorization, which is supported by widely used identity providers.