Comprehensive guides and references for the OpenFrame platform
The Authorization Server Sso And Registration Flow module orchestrates multi-tenant user onboarding, Single Sign-On (SSO) integration, invitation-based registration, tenant self-registration, and password reset flows within the OpenFrame Authorization Server.
It acts as the glue between:
This module does not operate in isolation. It builds on:
The Authorization Server Sso And Registration Flow module is responsible for:
flowchart TD
Browser["User Browser"] --> AuthEndpoint["/oauth2/authorization/{provider}"]
AuthEndpoint --> Provider["External IdP<br/>Google / Microsoft"]
Provider --> Callback["/login/oauth2/code/{provider}"]
Callback --> AuthSuccessHandler["AuthSuccessHandler"]
AuthSuccessHandler --> InviteHandler["InviteSsoHandler"]
AuthSuccessHandler --> TenantRegHandler["TenantRegSsoHandler"]
InviteHandler --> InvitationService["InvitationRegistrationService"]
TenantRegHandler --> TenantRegistrationService["TenantRegistrationService"]
InvitationService --> MongoDB[("MongoDB")]
TenantRegistrationService --> MongoDB
AuthSuccessHandler --> UserService["UserService"]
UserService --> MongoDB
AuthSuccessHandler --> Redirects["Redirects Utility"]
Handled by:
SsoTenantRegistrationInitRequestTenantRegSsoHandlerTenantRegistrationRequestDefaultRegistrationProcessorFlow:
sequenceDiagram
participant User
participant Frontend
participant AuthServer
participant IdP as "OIDC Provider"
User->>Frontend: Start SSO tenant registration
Frontend->>AuthServer: POST init request
AuthServer->>User: Set COOKIE_SSO_REG
User->>IdP: Authenticate
IdP->>AuthServer: OIDC callback
AuthServer->>AuthServer: TenantRegSsoHandler.handle()
AuthServer->>AuthServer: TenantRegistrationService.registerTenant()
AuthServer->>User: Redirect to tenant context
Key behaviors:
OidcUserUtils.resolveEmail().RegistrationProcessor.Handled by:
InvitationRegistrationRequestSsoInvitationAcceptRequestInviteSsoHandlerDefaultRegistrationProcessorFlow:
sequenceDiagram
participant User
participant AuthServer
participant IdP
User->>AuthServer: Accept invitation
AuthServer->>User: Set COOKIE_SSO_INVITE
User->>IdP: Authenticate
IdP->>AuthServer: OIDC callback
AuthServer->>AuthServer: InviteSsoHandler.handle()
AuthServer->>AuthServer: InvitationRegistrationService.registerByInvitation()
AuthServer->>User: Redirect to tenant dashboard
Notable details:
switchTenant flag enables cross-tenant onboarding.DTOs:
PasswordResetDtos.ResetRequestPasswordResetDtos.ResetConfirmResetTokenUtilPassword policy (enforced via annotations):
Token generation:
- 32 random bytes
- SecureRandom source
- Base64 URL-safe encoding
- No padding
Security characteristics:
AuthSuccessHandler is the central post-login coordinator.
Responsibilities:
lastLogin timestampFor Google and Microsoft:
email_verified claim exists and is false → do not verifyflowchart TD
Auth["Authentication Success"] --> ExtractEmail["Resolve Email from OIDC Claims"]
ExtractEmail --> CheckProvider{"Google or Microsoft?"}
CheckProvider -->|No| Continue["Continue"]
CheckProvider -->|Yes| ClaimCheck{"email_verified false?"}
ClaimCheck -->|Yes| Continue
ClaimCheck -->|No| MarkVerified["Mark Email Verified"]
Client registration strategies:
GoogleClientRegistrationStrategyMicrosoftClientRegistrationStrategyDefault provider configurations:
GoogleDefaultProviderConfigMicrosoftDefaultProviderConfigDesign principles:
DTOs:
TenantDiscoveryResponseTenantAvailabilityResponseThese enable:
This supports smart login UX in the frontend.
Defined in SsoRegistrationConstants:
COOKIE_SSO_REG
COOKIE_SSO_INVITE
ONBOARDING_TENANT_ID
These cookies:
Redirects utility provides:
AuthStateUtils:
JSESSIONIDThe module is designed for override via Spring conditional beans:
RegistrationProcessorUserDeactivationProcessorUserEmailVerifiedProcessorGlobalDomainPolicyLookupDefault implementations are no-op and activated only when no custom bean exists.
This allows:
flowchart LR
Gateway["Gateway Service"] --> AuthServer["Authorization Server"]
AuthServer --> Mongo[("MongoDB")]
AuthServer --> ApiService["API Service"]
Frontend["Frontend Tenant App"] --> Gateway
The Authorization Server Sso And Registration Flow module:
The Authorization Server Sso And Registration Flow module is the identity onboarding backbone of OpenFrame.
It provides:
By separating flow orchestration, provider strategy, tenant resolution, and persistence integration, this module enables flexible enterprise-grade authentication while preserving strict tenant isolation and security guarantees.