Delegating Access to Subsystems

If your app has multiple subsystems, it may make sense to allow only a minimal list of scopes needed in the subsystem.

All you need is an already generated access token containing all scopes to be delegated and the zaikio.delegations.rw scope.

Create an access token with the zaikio.delegations.rw scope and other required scopes (e.g. with the Redirect Flow).

It is important to be aware that this only works for OAuth confidential apps.

Request access token for subsystem

Send a POST request to https://hub.zaikio.com/oauth/delegate with the generated access token provided in the Authorization header. The following parameters must accompany the request:

Name	Description
client_id required	The client ID of your subsystem App as generated by the Zaikio Hub.
delegate_access_scope	A comma-seperated list of the scopes you want authorisation for. You can only request scopes that were granted for the parent access token. It is not possible to pass zaikio.delegations.rw again. A delegate access token cannot be used to create a new delegate access token.

The response will include a new access token:

{
  "access_token": "749ceefd1f7909a1773501e0bc57d5b2",
  "refresh_token": "be4ae927cf49466293049c993ad911b2",
  "token_type": "bearer",
  "scope": "zaikio.person.read",
  "audiences": ["directory"],
  "expires_in": "2019-12-03T08:57:35.958Z",
  "bearer": {
    "id": "29b276b7-c0fa-4514-a5b1-c0fb4ee40fa7",
    "type": "Person"
  }
}

<?xml version="1.0" encoding="UTF-8"?>
<OAuth>
   <access_token>749ceefd1f7909a1773501e0bc57d5b2</access_token>
   <refresh_token>be4ae927cf49466293049c993ad911b2</refresh_token>
   <token_type>bearer</token_type>
   <scope>zaikio.person.read</scope>
   <audiences>directory</audiences>
   <expires_in>2019-12-03T08:57:35.958Z</expires_in>
   <bearer>
     <id>29b276b7-c0fa-4514-a5b1-c0fb4ee40fa7</id>
     <type>Person</type>
   </bearer>
</OAuth>

access_token=749ceefd1f7909a1773501e0bc57d5b2&token_type=bearer

Authentication

When using the delegate flow authentication needs to happen by using the Authorization: Bearer <your API token> header authentication method. It is required that this access token was created with confidential credentials.