Learning

Flows

How the common login and token flows work – who talks to whom, what travels along and where it goes wrong. Click a step or play the flow.

1. The five sections: Flows, Basics, Glossary, Errors, Checklist.
2. The choice by group: OAuth 2.0 & OpenID Connect, SAML 2.0 and Session. Deprecated flows are struck through.
3. The status: Recommended, For its purpose, Use with care or Deprecated.
4. The sequence diagram: dashed via the browser, solid from server to server, dotted local.
5. The selected step with what travels along. Back, Next and Play walk through the flow.
6. What to watch and What the tracer checks.

The flows: Authorization Code + PKCE, code flow via a backend (BFF), client credentials, refresh token with rotation, device code, on-behalf-of / token exchange, DPoP, the implicit flow and the password grant (both deprecated), SAML started by the SP and by the IdP, OAuth2 SAML Bearer and logout. If AuthTailor recognises a flow in your input, a click on the flow in the result opens exactly that one and shows what was found in your input. The flows for SAP BTP are in SAP.

Basics

The essentials of SAML, OAuth 2.0 and OpenID Connect in ten short chapters – what the tracer checks, and why.

1. An opened chapter with explanation and Typical errors.
2. See the flow opens the matching flow.

The chapters: SAML, OAuth and OpenID Connect – who does what · The tokens and what they are for · A JWT, taken apart · Signatures, keys and certificates · state, nonce, PKCE, InResponseTo – the bindings of a flow · Cookies, sessions and logout · Tokens in the browser – where they leak · Time, clocks and lifetimes · Passkeys and WebAuthn · The page around the login: CSP, CORS, SRI, redirects.

Glossary

1. Search terms … filters more than 50 terms from ACS to XSUAA.
2. more → opens the chapter in Basics that explains the term.

Errors

Known error messages with cause and fix. If you paste a message into Auth Trace, AuthTailor recognises it automatically.

1. Search error codes or text … – by code, title, cause or fix.
2. An entry with title, codes, Cause and Fix.

Checklist

Before going live: 16 items in the groups Flow, Tokens and signatures, Browser and Session and logout.

1. The counter of items done.
2. A ticked item.