Management API mechanism

Using the Management API mechanism for SSO is straightforward: use your Management API client credentials together with the sso-token received from the browser to make an HTTP POST request to https://{your-id-server}/api/rest/v1/sso/token/<sso-token>. The response is the same User representation you would get from the normal user endpoint at https://{your-id-server}/api/rest/v1/user/<userId>.

Consuming the token requires the ACCOUNT_FIND permission on the user's namespace, and removes the token so it cannot be consumed again.

Example request for consuming sso-token

curl -i -X POST -H 'Accept: application/json' --user '<clientId>:<clientSecret>' https://{your-id-server}/api/rest/v1/sso/token/<sso-token>

Example response from SSO token endpoint

{
    "email":"[email protected]",
    "emailVerified":false,
    "id":"58cfb7353874e103fc81ec5f",
    "locale":"en_GB",
    "locked":false,
    "meta":{
        "created":"2017-03-20T11:04:21.534Z",
        "lastModified":"2018-09-21T06:29:05.708Z",
        "location":"https://{your-id-server}/api/rest/v1/sso/token/<sso-token>"
    },
    "mobile":"+358401234567",
    "mobileVerified":true,
    "name":{
        "familyName":"Smith",
        "givenName":"John"
    },
    "nsCode":"test",
    "orgCode":"test",
    "preferredLanguage":"en_GB",
    "username":"john.smith"
}