1. Unified Authentication Service Overview
Unified Authentication Service (UAS) is HOPEX web-based authentication system. UAS is a centralized service, which enables to manage several authentication types:
• External authentication or Single Sign-On (SSO)
SSO is an authentication system enabling users to login with a single ID and password to access HOPEX and any other Customer application types like web or mobile, access control for APIs, and federation (support for external identity providers like Google and enterprise identity management systems via SAML2).
UAS manages two standard authentication protocols:
• SAML2
Security Assertion Markup Language 2.0 (SAML 2.0) is a version of the SAML standard for exchanging authentication and authorization data between security domains.
SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end-user) between a SAML authority (Identity Provider), and a SAML consumer (Service Provider).
SAML2 Specifications: https://tools.ietf.org/html/rfc7522
• Open ID Connect
OpenID Connect (OIDC) enables to implement a centralized identity federation and respond to SSO issues.
OIDC specifies an HTTP Restful authentication interface and relies on the OAuth2 protocol to do delegation authorization, i.e. in most of the cases, the end user no longer needs to directly provide credentials to a third-party application. OIDC also uses the JSON Web Token (JWT) exchange formalism to convey user identities to applications, as well as their roles / entitlements.
Open ID Specifications: http://openid.net/connect/
These protocols are supported by some Identity Providers (IDPs) like Azure AD, AD FS, OKTA, Google.
• Authentication through HOPEX platform
If you do not have any external authentication module, you can use HOPEX platform to manage user authentication (HOPEX or Windows).
See HOPEX Administration (Web) documentation for information regarding authentication through HOPEX platform.
If needed, you can define several providers of OpenID and/or SAML2 types.
