Ncloud Single Sign-On concept

Available in Classic and VPC

Before learning how to integrate Ncloud Single Sign-On, this section describes some concepts required for Ncloud Single Sign-On integration. The following are the main concepts to be explained.

• OAuth 2.0 definition
• OAuth 2.0 roles
• OpenID Connect
• Access Token
• Refresh Token
• ID Token
• OAuth 2.0 authentication flow
• SAML 2.0 definition
• SAML 2.0 roles

OAuth 2.0 definition

OAuth 2.0 is an open standard authorization protocol for granting permissions. OAuth 2.0 delegates permission for an application to access a resource server on behalf of a user who owns the resource.

OAuth 2.0 roles

The roles defined in OAuth 2.0 are as follows:

OpenID Connect

OpenID Connect is a protocol that is based on OAuth 2.0 and issues an ID token containing user information from IdP when issuing a token.

Access Token

Access token refers to a string issued by the IdP that serves as a credential indicating the client's authorization to access protected resources. Clients can access the resource server using an access token.

Refresh Token

Refresh Token is a token issued by IdP used to extend the expiration time of an expired access token or to issue additional access tokens with the same or narrower scope. When the client sends the access token issuance API including the refresh token to the IdP, it verifies that it has not been forged or altered and issues an access token.

ID Token

An ID token is a JWT format token that contains user information and is issued by the IdP along with an access token if you include id_token in scope when requesting token issuance.

OAuth 2.0 authentication flow

The flow of the OAuth 2.0 authentication protocol is as follows:

• Authorization code flow
• PKCE flow
• Implicit flow

Authorization code flow

The authorization code flow is the most common authentication flow, and the description of the flow is as follows:

1. The resource owner clicks the login button to initiate the flow.
2. The client sets the response type to code to access the protected resource and requests permission.
3. The IdP sends the resource owner the consent page and login page for providing privacy information.
4. The resource owner approves the granting of permission by agreeing and logging in.
5. The IdP sends the authorization code to the client.
6. The client requests the issuance of an access token from the IdP using the authorization code.
7. The IdP verifies the authorization code and issues a token.
8. The client with the access token accesses the resource server and requests the protected resource.
9. The resource server delivers the requested resource to the client.

PKCE flow

The PKCE flow is an authorization code flow that enhances security when proceeding with the flow, and the description of the flow, including PKCE, is as follows:

1. The resource owner clicks the login button to initiate the flow.
2. The client generates a code verifier and code challenge.
3. If you include the code challenge and code challenge method created by the client in the authorization request, the IdP will store the values.
4. The IdP sends the resource owner the consent page and login page for providing privacy information.
5. The resource owner approves the granting of permission by agreeing and logging in.
6. The IdP sends the authorization code to the client.
7. The client requests the issuance of an access token from the IdP by including the code verifier and authorization code.
8. The IdP compares the saved code challenge and code verifier to verify whether they match or not.
9. If the two values match, the IdP issues an access token.
10. The client with the access token accesses the resource server and requests the protected resource.
11. The resource server delivers the requested resource to the client.

Implicit flow

The implicit flow is suitable for client environments where it is difficult to securely store and manage credentials, and the flow is described as follows:

1. The resource owner clicks the login button to initiate the flow.
2. The client sets the response method to token and requests authorization.
3. The IdP sends the resource owner the consent page and login page for providing privacy information.
4. The resource owner approves the granting of permission by agreeing and logging in.
5. The IdP issues an access token.
6. The client with the access token accesses the resource server and requests the protected resource.
7. The resource server delivers the requested resource to the client.

SAML 2.0 definition

SAML 2.0 is a web-based, open standard authentication protocol. SAML 2.0 is a standard information format used when exchanging user authentication and authorization information between applications, allowing IdPs and SPs to securely exchange and authenticate user information.

SAML 2.0 roles

The roles defined in SAML 2.0 are as follows: