Authorization Forwarding Information

  • Updated

RedeApp offers third-party applications the opportunity to establish authentication forwarding for mutual customers via App Hub. 

With auth forwarding established, customers will have the ability to add an AppLink to their RedeApp network housing a URL that will send the user to the third-party site along with the user’s authentication information in the form of a signed JSON web token to confirm the user’s identity. 

 

Responsibilities and Process for Auth Forwarding

  • Customer:
    • The customer will use a custom URL provided by third-party and turn on ‘Auth Forwarding’ when setting up the AppLink
  • RedeApp:
    • When a user taps the AppLink, RedeApp will generate the user’s JWT and append it to the third-party URL query string.
      • The JWT will contain the user’s: 
        • Network_id (unique identifier for each customer network) 
        • Employee_key (unique identifier within each customer network)
        • Account_id (unique identifier within the RedeApp platform)
        • Username
        • Email address
  • Third-party:
    • Third-party will decode the JWT to confirm the user’s employee_key. 
    • Verify the JWT signature using our Public Key (see below).
    • Then, authenticate the user into the system with the associated account. 

 

Example

  • In the network’s AppHub, publish an AppLink like this:
    • https://__your_site.com
  • And that redirects to:
    • https://__your_site.com?redeapp_jwt=eyJ0…
  • When the third-party backend (__your_site.com) decodes the redeapp_jwt, they can identify the user with the employee_key (red e key) within the JWT payload.

 

Our public key

Third parties should use our public key to verify the JWT (algorithm is RS256).

-----BEGIN PUBLIC KEY-----

MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3SGxHjfnSbanowaOY1/V

oW1AvpTdPuq4eHsG1k1qZ+56M6MKhBpiyqZyjyIWglTf972okplm0hmcvIVLuJQb

oGWXWXs4zqWpoutmpJOqDusa0yTlNIkuryXMLKa5LhrgjUsu9B6f2qSw+AK6GbMa

oPZRZWuuLKp1A2gz3lB0G1oZN5+a4B0rEtaqB2jeebysC6ns6S0hc8NmpxOfABCt

Lx/haFCDDcMsjNfU8J0c6MeVPsz8OdTntnN4wLrVdFnNf/fUCXSJdnbj39Tu7yS5

JfHnCv9cGLHf+VlWIkw3Q1eMnIu5urw7sJuEf6vpDrtHsuFg5p2MjABPksnmuL/i

kO+BCHG+LASkamxyrt3JZbpEhKNOcn3WUeVIHEkIK7nW2wY7MR9lkk1zgy9qsQ/k

KIGK4S0lWJKLKhKZcqFCXE+3w0wAfM3rb8XMHV5g9PZPByvJK6UG11O6fYzyC3y1

D7AXJmlY2GoqepBLW7V1ZE7wfVkisxfXPxYnNi7kjysEoBzWTLXjBbpuCTUI3psJ

Pi9Qax75jxdrcUvJd3Fq7JAuRWuUVQWvKqLhwI1mdMlx5RF7AVXeNwsMeFfOM/Jn

to+ePgRrdis7shnykv2gjF0yZblKTARQbS+8EjFrUyOIVfYkM67IkabtNxa5r+S4

qMJAJq6Gdqi2g3AlWpJ793kCAwEAAQ==

-----END PUBLIC KEY-----

 

If a customer is interested in going further with REA integrations, please see our Public API Readme.

 

Related articles