Overview

Cloud Native Build integrates with existing authentication systems via OAuth 2.0 to enable Single Sign-On (SSO), allowing users to access the platform with existing credentials.

Authorization Code Grant Type

Cloud Native Build supports the OAuth Authorization Code Grant Type for web and native applications to obtain access tokens after user authorization.

Workflow

The diagram above illustrates the complete OAuth Authorization Code Grant flow.

1. The user accesses the Cloud Native Build platform.
2. The client app calls the authorization server's authorize endpoint.
3. The authorization server returns a redirect URI, directing the user to the authorization page.
4. The user authenticates via their identity source (e.g., username/password) and grants consent.
5. The authorization server issues an authorization code (code).
6. The client app sends the authorization code to the token endpoint for authentication.
7. The authorization server validates the authorization code (code), Client ID, and Client Secret.
8. The authorization server returns an access token.
9. The client app sends the token to the resource server to request protected resources.
10. The resource server validates the token and returns the requested resources.

Configuration

Go to the Admin Management Platform to create login configurations for third-party services.

The login configuration requires the following parameters:

Required Parameters

• Client ID String: Client ID that identifies the application, used together with the secret for authentication.
• Client Secret String: Client secret that verifies the application identity, used together with the ID for authentication.
• Scope String: Permission scope, defining the read/write permissions of the token provided by the authorization service.
• Authorization Method String: Currently only supports auto-detection.
• Authorization Request URL String: Service address for the application to request OAuth authorization.
• Token Request URL String: Service address for the application to obtain tokens.
• User Info Request URL String: Resource service address for the application to request user resources after obtaining the token.

Optional Parameters

• Synchronous Logout URL String: URL for the application to request synchronous logout of OAuth users after the user logs out.
• User ID Mapping Attribute String: Map the specified attribute of the user resource to the openid field in the Cloud Native Build user table.
• User Account Mapping Attribute String: Map the specified attribute of the user resource to the name field in the Cloud Native Build user table.
• User Name Mapping Attribute String: Map the specified attribute of the user resource to the nick field in the Cloud Native Build user table.
• User Email Mapping Attribute String: Map the specified attribute of the user resource to the email field in the Cloud Native Build user table.
• User Avatar Mapping Attribute String: Map the specified attribute of the user resource to the avatar field in the Cloud Native Build user table.
• Prompt Message Mapping Attribute String: Map the specified attribute of the user resource to the msg field in the Cloud Native Build user table.
• Synchronization Permission Settings String: Whether to allow importing users to modify name/account/email fields.