PCA - User-based authorisation

Quick intro

Many of the PCA API operations can be accessed by applications with the authorisation of their currently logged in user.

The following summarizes the user-based authorisation mode of accessing the PCA API:

• Applications (i.e. ClientSystems) obtain PCA API OAuth 2.0 access tokens from the PCA Identity and Access Manager using the OAuth 2.0 “authorization_code” grant type.
• The PCA Identity and Access Manager issues PCA API access tokens which are only valid for a limited time – no refresh tokens are issued. Clients must delete them when the user session is no longer active

The figure shows the user-based authorisation pattern for the case where the ClientSystem has its own local user identity and authorisation implementation.  In this case a local user session, hosted by the ClientSystem,  is established in step 1 – but the user is then required to authenticate separately to PRODA for the PCA API access tokens to be issued to the PCA Web Application (steps 2 to 14). 

The case where the ClientSystem is the PCA Portal, or any similar web application that natively authenticates its users via PRODA, is the same as in figure above except that steps 1 and 2 are replaced by the user navigating with their browser to the web application web site.

Note that the PCA Portal is also an OAuth 2.0 client of the PCA Identity and Access Manager like all other clients of the PCA APIs – i.e. it is also a ClientSystem.