Si-des Authv1.0 ENTERPRISE

Developer Integration Portal

Complete protocol specifications, interactive developer tools, SOAP 1.1/1.2 contracts, and 4-language SDK quickstarts.

WSDL 1.1 ContractOIDC Discovery JSON

Architecture & Core Standards

Si-des Auth enforces zero-trust identity delegation across web apps, SPAs, native apps, APIs, and enterprise SOAP services.

How Si-des Auth Works

Three actors, every integration: your app's own server (which never touches a password), the user's browser (which carries redirects between the two, but never a secret), and Si-des Auth itself (the only place a credential or session is ever checked).

End UserYour App (Third Party)Si-des AuthBrowserno secrets held here/api/auth/logingenerates PKCE pair/oauth/authorizecollapses request → flow id1. click "Sign in"2. redirect + code_challenge/login or /signupArgon2id password check+ optional MFA(TOTP / email OTP /WebAuthn passkey)+ optional /consent(off by default per client)34. user authenticates directly with Si-des Auth (your app never sees the password)Browser/api/auth/callback5. redirect with one-time code/oauth/token6. server-to-server:code + client_secret + code_verifier7. RS256 access + ID + refresh tokensYour sessionverifies id_token vialive JWKS, sets your cookieMongoDB / DynamoDBusers, sessions, tokens,audit log — swappable backendBrowser-mediated (redirect)Direct server-to-server (secret required)Rendered by Si-des Auth
Authorization Code Flow with S256 PKCE (RFC 7636)
1. Auth Request

Client sends user to /oauth/authorize with code_challenge and redirect_uri.

2. Authenticate

User validates identity via Argon2id credentials, step-up MFA, and concurrent session checks.

3. Code Callback

Server redirects to client callback with 60-second single-use authorization code.

4. Token Issuance

Client calls /oauth/token presenting code_verifier; server returns RS256 JWTs.

Token Format & Mandatory Claims (Section 8.2)

ID Token Claims (OpenID Connect)

  • iss: Stable issuer URL (https://auth.sides-tech.com)
  • sub: Stable, opaque tenant-scoped UUID (never email address per FR-OIDC-014)
  • aud: Client application ID
  • exp / iat: 15-minute default validity period
  • session_id: Correlated active session identifier
  • amr / acr: Authentication assurance method (e.g. pwd, totp, email_otp)

Access Token & Refresh Rotation

  • Signed with RS256 algorithm; verifiable via JWKS keyset
  • Clock skew tolerance enforced at maximum 60 seconds (FR-OIDC-018)
  • Refresh token rotation issues a new refresh token on every exchange
  • Reuse Detection: If a superseded refresh token is used, the entire session family is revoked immediately

Every Auth Event Is Logged

Sign-in, sign-up, forgot-password, password reset, and every MFA attempt (TOTP, email OTP, WebAuthn) — success or failure — is recorded to your tenant's audit trail with:

IP Address
Browser & Device
Location
Timestamp

Parsed from the real request (a genuine browser name, not a raw User-Agent string) rather than guessed — visible per-event in your Admin Console's Audit Trail and Security & Risk Alerts tabs, and available for anomaly detection (impossible-travel, credential stuffing) and outbound webhooks (see Webhooks & SIEM Integration).