Architecture

Edge clients use JWT access tokens for authentication and authorization at cloud and edge services. Each client has its own unique tokens. To get the tokens, the client needs to be onboarded.

The specific onboarding process depends on the client type (application). Multiple options may be available. Generally, a privileged user (e.g. administrator) logs in, creates an onboarding token and provides it for an installation process. The installation process onboards the client by calling the Client Identity Management Service. It provides the onboarding token and some additional information (tenant identification, business unit identification, etc.) needed to register a client. The Client Identity Management Service responds with access and refresh tokens.

The onboarding token is valid for a defined period of time and may be used to onboard one or more clients. All of this depends on the token restrictions included during token creation.

There are two access token types: cloud and edge. A cloud access token can be used by a client to access cloud services only, an edge access token can be used by the client to access edge services only. A cloud access token has a more limited lifespan compared to the edge access token. The lifespan of the edge access token must be long enough to ensure that it does not expire while a store is offline in relation to central services. Based on the client type, the client uses a cloud access token and may use an edge access token.

Onboarding, access, and refresh tokens are signed by private keys. Edge and cloud services use public certificates to validate tokens from clients. Services download the public certificates from the Client Identity Management Service. The Client Identity Management Service provides the public certificates from Keycloak.

Access and refresh tokens are time-limited. The client must refresh them regularly. When an access token expires, the client cannot communicate with the services. When the refresh token expires, the client cannot obtain new tokens and must be re-onboarded.

The Client Identity Management Service does not issue onboarding, access, and refresh tokens on its own. It uses Keycloak to do so. To create an onboarding token, the service creates a client in the clients-onboarding realm in Keycloak. After the client is created, Client Identity Management authenticates as the client and obtains a JWT access token. The token is used as the onboarding token. For an onboarded edge client, the Client Identity Management Service creates a client in the clients realm and a client in the clients-edge realm. The client in the clients-edge realm is created only if the edge client needs to communicate with edge services. Client Identity Management authenticates the clients in the clients and clients-edge realms and obtains JWT tokens. The tokens are provided for the edge client.