IAM

IAM APIs for authentication and token management.

Authentication

The IAM authentication service is a service used internally in TSB to authenticate the different components of the platform and to provide JWT token lifecycle management.

Authenticate

Refresh

RevokeToken

Credentials

Credentials used in the authentication API, to be exchanged by a bearer access token and a refresh token.

Field	Description	Validation Rule
basic	tetrateio.api.iam.v1.Credentials.BasicAuth oneof _auth Basic username/password authentication.	–
token	tetrateio.api.iam.v1.Credentials.TokenAuth oneof _auth Token based authentication.	–
nonce	tetrateio.api.iam.v1.Credentials.OIDCNonce oneof _auth OIDC nonce based authentication.	–

BasicAuth

Credentials used to authenticate using HTTP Basic.

Field	Description	Validation Rule
username	string REQUIRED The login username.	string = {   min_len: 1 }
password	string REQUIRED The password.	string = {   min_len: 1 }

OIDCNonce

OIDC nonce based credentials

Field	Description	Validation Rule
nonce	string REQUIRED	string = {   min_len: 1 }

TokenAuth

Token based credentials

Field	Description	Validation Rule
token	string REQUIRED Bearer access token.	string = {   min_len: 1 }

RefreshTokenRequest

Request to refresh a bearer access token. The body of the message is empty as the refresh token will be provided in the request authentication.

RevokeTokenRequest

Request to revoke a set of tokens.

Field	Description	Validation Rule
tokens	List of string REQUIRED List of tokens to revoke.	repeated = {   min_items: 1   items: {string:{min_len:1}} }

SuccessfulAuthentication

Contains a Bearer Access Token and a Refresh Token as the result of a successful authentication.

The Bearer Token is used to authorize requests from users. This token is a proof that a user is authenticated and can be used to issue authenticated requests to the target services. These tokens are usually short-lived.

The Refresh Token can be used to renew the bearer token if it's expired or lost. These tokens are usually long-lived.

Field	Description	Validation Rule
bearerToken	string The bearer access token that can be used to access protected resources on behalf of the authenticated principal.	–
refreshToken	string The refresh token that can be used to obtain new bearer access tokens.	–