Client Onboarding

Client Onboarding - Desktop Applications

This chapter describes the onboarding process for a desktop application, e.g. Cloud POS Client.

A privileged user logs in to Employee Hub and opens an Employee Hub function for the Cloud POS installation. The user enters required information such as retail store ID and workstation ID. The function calls the Client Identity Management Service to create an onboarding token. The onboarding token is included in the activation token provided for use in the function.

The activation token is entered into the Cloud POC Launcher. The application takes care of the installation process. It downloads all necessary installation packages including the Cloud POS installer. The installer not only installs the Cloud POS but also the Client Onboarding App. After the installation, the installer calls the Client Onboarding App with the onboarding token and other parameters needed for client onboarding. All of it comes from the activation token. The Client Onboarding App calls the Client Identity Management Service to onboard the client. The Client Identity Management Service validates onboarding token usage and registers the client. After successful registration, the Client Identity Management Service provides two access tokens (cloud & edge), a refresh token, and some additional information. The Client Onboarding App persists tokens into auth-tokens.properties and the additional information (tenantId, businessUnitId, URLs, etc.) into station.properties. To protect sensitive information, the tokens are encrypted by Client Onboarding App before persistence.

Client Onboarding - Edge Services

Client onboarding for edge services is done in the same way as client onboarding for desktop applications. There are slight differences in the installation process, e.g. a service is deployed into an application server. There is a minor difference in the client onboarding response. The edge access token is provided for the client only if it needs to communicate with other services in the store network.

Client Onboarding - Mobile Applications - In-app

An onboarding function is automatically opened in the client application if the client it is not onboarded. A privileged user (e.g. administrator or store manager) logs in and provides the information needed for client onboarding. The login takes place at the Auth Service. The Auth Service provides a user JWT access token.

The client calls the Client Identity Management Service to onboard itself. The client provides information needed for onboarding and the user JWT access token to authenticate and authorize the request. The Client Identity Management Service validates user token usage and registers the client. After successful registration, the Client Identity Management Service provides one or two access tokens, a refresh token, and some additional information. The Client Onboarding App persists tokens into auth-tokens.properties and the additional information (tenantId, businessUnitId, URLs, etc.) into station.properties. To protect sensitive information, the tokens are encrypted by the client before persistence.

Client Onboarding - Mobile Applications - QR Code

A privileged user (e.g. administrator or store manager) logs in to Employee Hub and navigates to a generic application function or an installation function for a specific client. The user defines token restrictions for an onboarding token. For example, the user defines that the token is valid for Mobile POS Clients in a store. Afterwards, the function calls the Client Identity Management Service, which generates an onboarding token. The function displays a QR code with an onboarding token and additional information.

The QR code is scanned by the client application on a mobile device. If the QR code contains all of the information needed for client onboarding, the client calls the Client Identity Management Service. The Client Identity Management Service validates onboarding token usage and registers the client. After successful registration, the Client Identity Management Service provides one or two access tokens, a refresh token, and some additional information. The client persists tokens into auth-tokens.properties and the additional information (tenantId, businessUnitId, URLs, etc.) into station.properties. To protect sensitive information, the tokens are encrypted by the client before persistence.

Client Onboarding - Mobile Applications - MDM

A privileged user (e.g. administrator) logs in to Employee Hub and navigates to a generic application function or an installation function for a specific client. The user defines token restrictions for an onboarding token. For example, the user defines that the token is valid for industry Self Scanning Clients in a store. Afterwards, the function calls the Client Identity Management Service, which generates an onboarding token. The onboarding token is displayed for the user.

The user takes the onboarding token and some additional information (URL of the central services, tenantId, businessUnitId, etc.) needed for client onboarding and assigns it to one or more clients (devices) in the MDM solution. The MDM solution distributes it to the clients. The MDM solution usually places it into a file in a file system on the target device.

When a client application is started on the mobile device, it finds the onboarding token and additional information needed for client onboarding. The client calls the Client Identity Management Service. The Client Identity Management Service validates onboarding token usage and registers the client. After successful registration, the Client Identity Management Service provides one or two access tokens, a refresh token, and some additional information. The client persists tokens into auth-tokens.properties and the additional information (tenantId, businessUnitId, URLs, etc.) into station.properties. To protect sensitive information, the tokens are encrypted by the client before persistence.