SSO - Authentication Code Grant Integration

Before you begin the development of your browser-based application, contact USTA to discuss what data you will need to access from USTA.  Credentials will be issued for use to connect via HTTP.

Credentials:

1. client id

2. client secret

USTA Admin will register your application as a client in the Okta configuration.

Add a link in the form of:

https://stage-account.usta.com/authorize?client_id=[your_client_id]&response_type=code&scope=openid offline_access&redirect_uri=[your_redirect_url]&audience={audience_id}&state={state}

When the token for the authorized customer is needed Client API application needs to follow typical OAuth 2.0 flow using authorization code grant type. To perform such flow Client API should be registered in the USTA authentication service and should have valid:

• clientId - generated for every API Client during registration

• secret - generated for every API Client during registration

• callbackUri - an endpoint where authorization code will be passed after successful login - should be configured for all clients

• state - a random generated value such as UUID to prevent CSRF attacks. ie '29ca0dd4-966d-400d-9abc-570568f5c339'

To perform login as a customer, API Client application should follow such steps:

Client App redirect to login or authorize URLs:

1. https://stage-account.usta.com/authorize - can be used for authentication.

2. client_id={clientId} - mandatory, for example: 25idmdru0ucur4loa3hklcvpsa

3. response_type=code - mandatory

4. scope={requested scopes} - openid offline_access email

5. state - a random generated value such as UUID to prevent CSRF attacks. ie '29ca0dd4-966d-400d-9abc-570568f5c339'

6. audience={audeince_id}

7. redirect_uri= mandatory