Open ID Connect Auth
Gatekeeper authenticates users with the global authorization service. Gatekeeper has two layers of authorization. Application authorization and user authentication, if applicable, is managed by a global authorization service that uses OAuth 2.0 standard for application (client) authorization and OpenID Connect (OIDC) for user authentication. From Gatekeeper’s point of view, the principals can be either authenticated users or applications (service principals). API-specific permissions for principals are controlled by the Gatekeeper authorization service.
Global authorization service
Gatekeeper uses a shared Nuance authorization service (referred to as GlobalAuth) that performs user authentication (where applicable) and client authorization for calling the APIs. The service provides authorization tokens to applications so that they can invoke the Gatekeeper API. The service supports various types of applications such as single page web applications, client-server applications, and back end services. Tokens issued by the server are valid for a limited period of time and can be used to call an API method in any active Gatekeeper region within the same geography (geographical region such as US or Canada). The authorization service integrates with any existing IdP that supports the OpenID Connect protocol (such as Azure AD) for the purpose of user authentication.
Note:
To connect Gatekeeper to your IdP, configure a tenant on the Nuance server.Gatekeeper supports the following OAuth 2.0 grant types:
- Authorization code with PKCE - Recommended. Only relevant for end users and groups of users.
- Authorization code - Only relevant for end users and groups of users.
- Implicit - Only relevant for end users and groups of users.
- Client credentials - Only relevant for service principals.
For more information about OAuth 2.0 see: https://tools.ietf.org/html/rfc6749 . For more information about OpenID Connect see: https://openid.net/connect/ .
To authenticate end users, provision a customer-specific tenant in GlobalAuth. The customer must create an OpenID Connect client for Nuance. GlobalAuth uses the client to authenticate users for the tenant.
Nuance provides the OpenID Connect client return URL. The customer provides the Issuer, the Authorization Endpoint (authorizationURL), the Token Endpoint (tokenURL), the UserInfo Endpoint (userInfoURL), the Client Identifier, and the Client Secret.