The document outlines a guide for implementing single sign-on (SSO) in Mendix, aimed at making the process simpler. It covers SSO basics, various protocols like SAML and OAuth, along with a practical use-case example and implementation demo including login and logout flows. Key components discussed include authentication, the architecture of the example application, and critical steps for a successful implementation.

1. Single Sign-On in Mendix
How to keep it simple?
Menno de Haas
Mendix Expert / Team Lead
WebFlight

2. GOAL
Make single sign on in Mendix a little less scary…

3. Outline
• SSO basics
• Intro use-case
• Implementation
• Discussion

4. SSO basics
What do you need to know?

5. Authentication vs Authorization

6. SAML vs OAuth vs OpenID Connect

7. WHY is OAuth so hard?

8. OAuth 2.0 parties
Client application
Resource server
Resource owner
Authorization server

9. Intro use-case
A simple example…

10. Architecture
InvoiceApp
Invoice API
Resource owner = ME
Authorization server
Client application Resource server

11. What is NOT in the demo?
• How to configure your authorization server?
• How to choose the appropriate OAuth 2.0 flow?
• How to work with states during the login flow?
• How to work with JSON Web Tokens?
• How to validate tokens and scopes at API endpoints?

12. What IS in the demo?
• How to configure a login (authorization code) flow?
• How to configure a logout flow?

13. Implementation
Demo time!

14. Login flow
Mx Static HTML Mx REST API Mx SPA Auth0 IdP
login.html Initiate login Login screen Login screen
User consentUser consentCallback
index.html

15. Login flow
Mx Static HTML Mx REST API Mx SPA Auth0 IdP
login.html Initiate login Login screen Login screen
User consentUser consentCallback
index.html

16. Login.html

17. Login.html

18. Login flow
Mx Static HTML Mx REST API Mx SPA Auth0 IdP
login.html Initiate login Login screen Login screen
User consentUser consentCallback
index.html

19. Initiate login

20. Login flow
Mx Static HTML Mx REST API Mx SPA Auth0 IdP
login.html Initiate login Login screen Login screen
User consentUser consentCallback
index.html

21. Callback

22. Logout flow
Nanoflow Remove session Remove session
Redirect to
homepage
Mx SPA Auth0 IdP
index.html

23. Logout flow

24. Demo