Can a third-party application authenticate end users with Microsoft SSO directly and then use that token to call IFS Cloud's projection REST APIs while preserving the end user's own permissions?

All FAQ questions / Security and access

Answer

Not by using the external identity provider's token directly — IFS Cloud's IAM only accepts access tokens it issued itself, and swapping an external token for an IFS-issued one ("token exchange") is disabled by default and isn't something available to reconfigure in a standard SaaS setup; the supported pattern instead is to have the application's login flow go through IFS IAM itself (using the standard Authorization Code flow with PKCE), with IAM brokering the actual sign-in to your external identity provider behind the scenes — that way the token your app ends up with is always an IFS-IAM-issued one carrying the real end user's identity and permissions.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions