Storefront Gateway Support

Storefront Gateway fully supports the OAuth 2.0 (RFC-6749) and OpenID Connect base standards, as well as the Proof Key for Code Exchange (PKCE) extensions for Authorization Code Grant (RFC-7636) and OpenID Connect discovery protocols referenced in this guide. Although this guide presents only our recommended best practices according to each kind of application you may want to build, other options are available according to the defined standards, such as the now-deprecated Implicit and Hybrid authorization grant types, as well as the trusted-party Resource Owner Password Credentials Grant. In Storefront Gateway, as an extension to the OIDC and OAuth 2.0 standards, access, refresh, and ID tokens are all issued as JSON Web Tokens (JWTs, RFC-7519). This means that the tokens are no longer opaque to the RP. The RP can inspect JWTs to determine things like the token validity, or to perform verification by checking the expiry time and signature. Explanations on how to use the JWT for the purpose of authentication are provided in each application-specific SSO topic. Storefront Gateway supports the following scopes and supplies the respective claim data per scope:

Scope	Standard?	Description
`openid`	Y	Requests that Storefront Gateway issues an ID token (in addition to an access token) with at least the `sub` value populated. Requesting an ID token enables OIDC as opposed to OAuth 2.0.
`profile`	Y	Requests the `name`, `family_name`, `given_name`, `picture`, `locale`, and `updated_at` claims from Storefront Gateway.
`email`	Y	Requests the `email` and `email_verified` claims from Storefront Gateway.
`phone`	Y	Requests the `phone_number` and `phone_number_verified` claims from Storefront Gateway.
`offline_access`	Y	Requests that Storefront Gateway issues a refresh token along with the access token or ID token.
`com.uxpsystems.ulm.partner`	N	A Storefront Gateway extension scope. It enables use of the access token to call Storefront Gateway’s `/privacy/users//partners/` API for managing an user’s privacy settings for the requesting RP.
`com.uxpsystems.ulm`	N	A Storefront Gateway extension scope. It enables use of the access token to call any or all Storefront Gateway Rest APIs (including Process APIs) on behalf of this user.In other words, this effectively grants full control over the user. This scope should be limited to applications that will manage the user’s data such as a user’s self-service profile.
`entitlements`	N	Requests Storefront Gateway’s `entitlements` claims.
Storefront Gateway also supplies the following claim data, if requested using the appropriate scopes:

Claim	Standard?	Description
`sub`	Y	Stands for Subject and is a unique identifier for the user. This identifier for a given user may or may not be different for a each RP. This value is guaranteed not to change even if the user changes the properties of their account (for example, changes email address or phone number).If your application wants to store user data, it should use the Subject string as the unique identifier.
`email`	Y	Primary email address of a user
`email_verified`	Y	Specifies whether a user’s email address has been verified by Storefront Gateway
`phone_number`	Y	Mobile phone number of a user
`phone_number_verified`	Y	Specifies whether a user’s phone number has been verified by Storefront Gateway
`name`	Y	Full name of a user (that is, first name and last name)
`family_name`	Y	Last name of a user
`given_name`	Y	First name of a user
`picture`	Y	URL of where the user’s avatar is hosted
`locale`	Y	Language setting of a user, if available
`updated_at`	Y	The last time the user’s profile (that is, the Storefront Gateway User entity) was updated; expressed in UNIX Epoch timestamp format
`entitlements`	N	End user’s entitlements data for this relying party, if entitlements are configured.The entitlements system allows Storefront Gateway to provide access to information about some of a user’s Storefront Gateway Subscriptions without granting full access to all of that user’s Storefront Gateway data, through use of the `com.uxpsystems.ulm` scope. This is most useful for external relying parties controlled by entities outside of your organization who need to know if a user has an active subscription of a particular type. For example, a third-party streaming media service that your application resells, or to which your application provides access, can check that the user has purchased the service, and potentially what tier of service as well. Configuration of the entitlements system is outside the scope of this guide. Reach out to the Storefront Gateway team for more information about how Storefront Gateway Entitlements work.

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs