Authentication and Authorization in the Encompass Lending Platform
December 05, 2018 | Jamie Brooks
To minimize the exposure of user credentials, OAuth 2.0 uses access tokens, also known as bearer tokens, to represent specific permissions and periods of access, granted by the resource owner, and enforced by the resource and authorization servers.
Obtaining Access Tokens
The Encompass Lending Platform provides three ways to obtain an access token:
1.Client credentials grant: Ideal for headless,
2.Authorization code grant: This is the way to go for web applications built on top of Encompass Developer Connect. With this flow, the user is first redirected by the application to the authorization server where they authenticate themselves. Next, the user is redirected back to the application along with an authorization code where the application exchanges that authorization code for an access token.
3.Resource owner password credentials grant: This grant type is used for all other scenarios, like a
Regardless of the grant type, an application is always identified by a client ID and secret. Note, the OAuth client ID should not be confused with an Encompass client ID or instance ID.
An Encompass client ID is a unique,
Client credentials can be administered, in the Developer Connect or Partner Connect portals, by users with the Super Administrator persona.
Access tokens issued by the Encompass Lending Platform are backed by a sliding- window session with an idle timeout of 15 minutes and a total duration of up to 2 hours. To avoid expiry due to inactivity, an access token must be used as part of an API request or introspected at least once during its
Additional Protections
The “claims”, which are available in the introspection response, determine which products, features, tenants and actions an application can use as well as the concurrency limit and daily quota. More specifically, entitlements and rate limits are linked to the Encompass client ID (i.e. encompass_client_id), tenant access is governed by the identity type (i.e. identity_type) and Encompass instance ID (i.e. compass_instance_id) and
What’s Next?
To improve security and interoperability, Ellie Mae is currently working on several new features that use the OAuth 2.0 framework as a foundation.
One such feature is dynamic client registration. Today, OAuth clients must be administered through the Developer Connect or Partner Connect portals and this model works well when the number of applications is relatively small, but as usage grows, it is beneficial to automate the registration process. The client registration enables you to register (and maintain) OAuth 2.0 clients programmatically.
Another upcoming feature is
Pairing SAML 2.0 or OpenID Connect (OIDC) 1.0 with the OAuth 2.0 protocol opens the door for federated single
Join the Developer Summit at Ellie Mae Experience 19
To get more insights into best practices, strategies and techniques to innovate, extend and customize the Encompass Lending Platform and open APIs to meet your unique needs, join us at the Ellie Mae Experience 19 Developer Summit. This year, separate from our system administrator’s tracks and content, we invite you to attend our dedicated Developer Summit tailored for our developer community, including tracks focused on platform development, data and analytics,
Updated 10 months ago