User verification for external actions

External applications hosted on a remote server can authenticate the invoking user against OpenText Core Software Delivery Platform.

In this topic:

Overview

You can verify identity in either of two ways:

• Token-based verification (user_identity_token): Use this method when your external action has a server component and you need to verify the user's identity before performing backend operations.

• CORS-authenticated requests: Use this method for external actions without a server component that make direct REST API calls from the browser using the current user's session. Avoid this method if you have a server component, as it can lead to less secure implementations.

Verify user identity with a token

Configure the action URL to include user_identity_token.

Example URL pattern:

{bundle_url}/my_folder/index.html?...&user_identity_token={user_identity_token}

Recommended flow:

1. Extract user_identity_token from the request.

2. Decode and parse JWT claims.

3. Validate expiration (exp).

4. Retrieve the public key from https://<octane.example.com>/api/jwt/key.

5. Verify the token signature using that key.

Verify user identity using CORS authentication

After CORS is properly configured, the external app can make authenticated API requests (for example, api/current_user) using the current signed-in user context.