1

We have a web app which has certain APIs. Users of our webapp will use these APIs when they login to our webapp (like how many records me as a user do I own, user specific, etc). We are creating widgets that we plan to distribute to multiple clients.

So if our web app was hosted on www.coreapp.com, these widgets could be used by for example www.thirdpartyapp.com which will integrate our widget to their website.

The problem comes for authentication, basically our widget on the third party site will be communicating with our server, but the user will be logging in using the third party site's login mechanism. So when the widget on the third party site sends an API request what would be the best/standard way of authenticating the user on our app.

Also keeping in mind a few things.

  1. Our app has a users table, so any user using our APIs will need to have an account created on our app. That can be on demand (on first API request from third party widget we can create the user if he/she does not exist on our app user database)
  2. These widgets will be potentially used on hundreds of third party sites (which users various authentication mechanism for logging in to those sites)
  3. We have a spring boot app
Improve this question
3
  • 1
    Suppose a third-party app uses your widget and it sends a request to your server stating that the username is MillindaD. How would you know if that user MillindaD is the same MillindaD you have in your own users table?
    – Bart van Ingen Schenau
    Jul 1, 2020 at 11:03
  • 1
    Thats a good question, how would you propose to handle that?
    – MilindaD
    Jul 1, 2020 at 11:08
  • 1
    The requirement that the users register directly with you: is there a functional reason for this? In other words, is your relationship with the third party app provider or with every individual user or both?
    – JimmyJames
    Jul 1, 2020 at 13:34

2 Answers 2

Reset to default
2

This is easily solved through API Keys:

  1. The user logs in to your platform directly using their own username / password.
  2. The user then generates a new API Key from your web interface.
  3. The user shares this key with the third party, who stores the key under the user's profile on their end.
  4. On requests to your API, the widget uses the API Key for authentication instead of the user's personal credentials.

The only requirement here is that any third party site wishing to implement your widgets, must provide their users the means to enter their own API keys. At the base level, this is just one additional input field on the user's profile.

Improve this answer
1

You cannot do this, this seems like a flawed idea where security is misunderstood.

You have to decide who is the identity provider because the user will have to establish his/her identity with the provider. In your case it seems you are the identity provider and every other third party using your widget has their own identity providers?

Some options

  1. The widget either redirects user to a login page once they start using it so they can establish identity for your APIs.
  2. You integrate with the third party's identity system so when someone comes into your system with a token, you can authenticate the token against their system. If most of your third parties use an identity provider like Google/Microsoft/Facebook then you may just have to integrate with those and not use your own identity mechanism.
  3. Reevaluate if the widget needs to be protected (I am guessing yes so this is probably not an option)
Improve this answer
3
  • 1
    Right so when it comes to the second option you have mentioned, the third party will submit a token in THEIR format and we will validate the token using THEIR system and then depending on the result map it to the user in our app, and let the request continue? Am I correct?
    – MilindaD
    Jul 1, 2020 at 11:25
  • 1
    So we have a SSO login where if a user provides us a saml we have a cloud identity service (like auth0), we can then integrate that saml into our app and provide them with a link to login using that SSO for that third party user/organization.
    – MilindaD
    Jul 1, 2020 at 11:26
  • 1
    Could you elaborate on "If most of your third parties use an identity provider like Google/Microsoft/Facebook", will it be possible to do that in the backend without any user interaction based on the token sent by the third party (without any user interaction)?
    – MilindaD
    Jul 1, 2020 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.