# Authentication models

Authentication is setup on configuration level in the oData connector admin interface.

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2F0GTNbYzJCAAXPA35hYMP%2Fimage.png?alt=media&#x26;token=29230f75-280b-425d-8a3d-eb053363c3fa" alt=""><figcaption><p>Auth tab in the oData connector admins page</p></figcaption></figure>

## Different authentication models&#x20;

Each OData connector configuration has **three** authentication configuration categories, **Design time** and **Runtime** are mandatory.

**Design time** is used:

* During workflow design in Flow Studio, setting up machine steps and exploring projections

**Runtime** is used:

* During execution of user flows by any of the clients (mobile/web)
* Executing machine workflows&#x20;
* Running flows in Testbench&#x20;

{% hint style="info" %}
Each authentication configuration should be tailored to meet specific customer requirements and flow types. It is common to have multiple oData connector configurations within a solution for the different scenarios.
{% endhint %}

## Authentication flow type overview

### **Client Credential flow**

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FaFpmdRFiZAU40kJuNPtW%2Fimage.png?alt=media&#x26;token=4b950a4d-8fcb-439f-9cf9-a87496f68d05" alt=""><figcaption></figcaption></figure>

{% content-ref url="authentication-models/setup-client-credential-flow" %}
[setup-client-credential-flow](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-client-credential-flow)
{% endcontent-ref %}

### **Password Credentials flow**

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FDA1ecGKzPqbZKtEJt7ud%2Fimage.png?alt=media&#x26;token=874960c3-b195-400a-b4e4-0ca459ddb9f2" alt=""><figcaption></figcaption></figure>

{% content-ref url="authentication-models/setup-password-credentials-flow" %}
[setup-password-credentials-flow](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-password-credentials-flow)
{% endcontent-ref %}

### **Basic authentication**

Basic Authentication is not recommended for use with IFS Cloud as it is considered insecure and is disabled by default. But it's still supported by the oData connector.&#x20;

### **Authorization Code Flow**

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FcRswV1HqShHRlXCHqdxr%2Fimage.png?alt=media&#x26;token=39f5efee-4466-4f03-a8b2-d734b5612176" alt=""><figcaption></figcaption></figure>

{% content-ref url="authentication-models/setup-authorization-code-flow" %}
[setup-authorization-code-flow](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-authorization-code-flow)
{% endcontent-ref %}

### **OpenId flow**

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FSpvqNiMVKFxG4Fuqoi5R%2Fimage.png?alt=media&#x26;token=45fc9711-9576-40f3-b1dc-7f2a7756fabe" alt=""><figcaption></figcaption></figure>

{% content-ref url="authentication-models/setup-openid-flow" %}
[setup-openid-flow](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-openid-flow)
{% endcontent-ref %}

## Summary of authentication flows

Below is a summary of main features of each authentication flow to consider when configuring OData configurations based on customer requirements and flow types developed.

<table data-card-size="large" data-view="cards"><thead><tr><th>Authentication type</th><th>Applicable Flow app types</th><th>Flow clients</th><th>Available for OData auth. type</th><th>Options for flow user to authenticate to flow server</th><th>User authentication IDP</th><th>Flow User Authenticated in IFS</th><th>Remarks</th></tr></thead><tbody><tr><td><strong>Client Credentials</strong></td><td>User and machine workflows</td><td>All clients</td><td>Design/Runtime</td><td>Pw in Flow Server/Ext. IDP in Flow Server OpenId configuration</td><td>Only IFS IDP</td><td>One IFS Service User linked to IFS IAM Client</td><td>No possibility to log into Aurena with service user</td></tr><tr><td><strong>Password Credentials</strong></td><td>User and machine workflows</td><td>All clients</td><td>Design/Runtime</td><td>FPw in Flow Server/Ext. IDP in Flow Server OpenId configuration</td><td>Only IFS IDP</td><td>Flow user</td><td>Flow user, connector level setup could contain users IFS user Id</td></tr><tr><td><strong>Authorization Code</strong></td><td>User workflows</td><td>Only mobile clients</td><td>Runtime</td><td>Pw in Flow Server/Ext. IDP in Flow Server OpenId configuration</td><td>IFS/External IDP</td><td>Flow user</td><td>Usable when flow is connecting to different systems of which all require their own authentication, IFS being one of them</td></tr><tr><td><strong>OpenId</strong></td><td>User workflows</td><td>All clients</td><td>Runtime</td><td>IFS IDP setup in Flow Server OpenId configuration</td><td>IFS/External IDP</td><td>Flow user</td><td>Web client and Portal2 requires separate API Manager to be purchased/configured by customer</td></tr></tbody></table>

Flow documentation about authentication

{% embed url="<https://help.novacuraflow.com/connectors/areas/business-systems/ifs-applications/ifs-odata/authentication-in-ifs-cloud>" %}

{% embed url="<https://help.novacuraflow.com/connectors/areas/business-systems/ifs-applications/ifs-odata/configuring-ifs-odata-connector>" %}