MOBILE-ID · TRUSTED LTANS
Authentication and API security
Integrate backend clients with HTTPS and OAuth2; apply mTLS or signed requests under the relevant profile and connection boundary.
A standard starting profile
Backend clients use HTTPS and OAuth2 Client Credentials under provisioned settings. Authenticate at the authorization server, obtain a correctly scoped/audienced token and call the WSO2 API. This is the standard target profile; Mobile-ID confirms the actual configuration before integration.
| Step | Action | Result |
|---|---|---|
| Register | Agree application, organization, records and scopes. | Provisioned clientId, audience and least privilege. |
| Obtain token | POST grant_type=client_credentials to the provisioned tokenEndpoint. | Short-lived token; secret stays on backend. |
| Call REST | Bearer token, correlationId and idempotency key for mutating commands. | Receipt/Job; not automatic completion. |
| Reconcile | Follow Job/resource and retain original transaction mapping. | Report or exact resource revision. |
Who validates what?
| Layer | Responsibility |
|---|---|
| Keycloak / IAM | Issue client/service-account tokens under approved grants; no realm-admin role for partners. |
| WSO2 Gateway | Validate tokens/API policy/quota/routing; configured JWKS or introspection. |
| LTANS API Services | Enforce organization, record, business scope and action authority. |
| Adapter / Core | Map authorized clients/profiles; retain mandatory internal mTLS or signing. |
Portal users and machine clients
Portal users use provisioned GoPaperless SSO/OIDC federation; Authorization Code + PKCE applies to appropriate flows. Client Credentials represents the application, not a fabricated human session. Organization and object access are separately checked.
Expiry, key rotation and failures
| Situation | Handling |
|---|---|
| Expired token | Obtain a token; retain the command key and reconcile before retry. |
| 401 / 403 | Check issuer/audience/clock/key or scope/tenant; a new token grants no extra authority. |
| mTLS profile | Validate client certificates only where required; TLS can fail before HTTP. |
| Secrets | No tokens/secrets in URLs, logs, frontend or demo files. |