OAuth and Scopes
Introduction
The following sections provide introductory information on how OAuth and scopes work, as well as details on scopes generated in the Mendix Portal.
OAuth
OAuth is a standard for access delegation. It is commonly used as a way for users to grant websites or applications limited access, i.e. scopes, to their data without providing their credentials. Mendix uses OAuth 2.0.
In other words, OAuth allows a user with an account from one website or application to use those credentials to connect to another website or application. The process generally looks like this:
- The user goes to the login page of website/application A and clicks the button for signing in with credentials from website/application B.
- The user is asked to authenticate themselves on website/application B.
- Website/application B confirms the identity of the user to website/application A.
Scopes
Once the user is authenticated by website/application B, website/application A has a guarantee of their real identity. In addition, OAuth provides more complex functionality. For example, website/application B can communicate a set of information, such as the email address or the profile picture, and a set of rights to website/application A. This can only happen if the user grants certain rights.
For example, if the user grants website/application A permission to send their profile picture and last name to website/application B through a specific authorization page, then website/application B can display that information on their website. The scopes are the access rights to that information granted manually by the user during the authentication process.
Here is an example page where a user is asked to accept scopes on their Mendix account so that Wikipedia can access their profile information and display their name:
Generated Scopes
The following scopes provide access to data with user consent. They are generated automatically within the Mendix Portal.
This information is provided so that you can make an informed decision on whether you want to authorize or cancel the request for access to your personal information or app.
Profile Scope
With this scope, a website or application can access the user's basic profile information as recorded in Mendix. This scope contains the following user data:
- Full name
- Username
- Avatar
- URL of the user's personal website or blog
Email Scope
With this scope, a website or application has access to the user's email address.
OpenID Scope
This is one of the most common scopes. With this scope, website A, such as Mendix, is informed that website B, such as Wikipedia, wants to authenticate the user. Website B then receives the user's unique identifier.
Mendix Profile Scope
This scope is an extension of the profile scope. With this scope, a website can access the user's Mendix profile for the following user data:
- OpenID2 identifier
- Username
- Display name
- Avatar
- Biography
- Phone number
- Job title
- Name of the company the user belongs to
- Mendix internal identifier of their company
- Department (in their company)
- Location (via their company)
- URL of the user's personal website or blog
- LinkedIn profile
- Twitter account
Creating an App Scope
This is a Mendix-specific scope that is used by internal Mendix applications, as well as by SAP as a strategic Mendix partner. This scope allows a website/application or partner to create a Mendix application on behalf of the user.
Changing the Deployment Cloud Target of an App Scope
This is a Mendix-specific scope that is used by internal Mendix applications, as well as by SAP as a strategic Mendix partner. This scope allows a website/application to change the platform to which an app will be deployed.