Share this page

# User verification for external actions

External applications hosted on a remote server can authenticate the invoking user against OpenText Software Delivery Management.

In this topic:

## Overview

You can verify identity in either of two ways:

- Token-based verification (`user_identity_token`): Use this method when your external action has a server component and you need to verify the user's identity before performing backend operations.

- CORS-authenticated requests: Use this method for external actions without a server component that make direct REST API calls from the browser using the current user's session. Avoid this method if you have a server component, as it can lead to less secure implementations.

## Verify user identity with a token

Configure the action URL to include `user_identity_token`.

Example URL pattern:

    {bundle_url}/my_folder/index.html?...&user_identity_token={user_identity_token}

### Recommended flow:

1. Extract `user_identity_token` from the request.

2. Decode and parse JWT claims.

3. Validate expiration (`exp`).

4. Retrieve the public key from `https://<octane.example.com>/api/jwt/key`.

5. Verify the token signature using that key.

Note:

- For GDPR compliance, users must consent to share identity information before using this token.

- The JWT key API is technical preview and requires the ALM-OCTANE-TECH-PREVIEW request header.

## Verify user identity using CORS authentication

After CORS is properly configured, the external app can make authenticated API requests (for example, `api/current_user`) using the current signed-in user context.

### To verify identity using CORS authentication:

1. Set CORS_ENABLED to true.

2. Ensure CORS_ALLOW_ORIGIN includes the external action server base URL.

3. Set SAME_SITE_COOKIE_ATTRIBUTE to None.

https://admhelp.microfocus.com Software Delivery Management 8942
Tips to improve your search results... OpenText™ Software Delivery Management Help Center OpenText™ Software Delivery Management Help 26.3 All View Local Help Center View Online Help Center Version: