OAuth Applications and Veracross Overview

Overview

You can now create OAuth applications for vendors using Veracross. OAuth applications allow for vendors to use Veracross OAuth SSO to enable login to their vendor applications. This can provide a few benefits for Veracross end users:

• User experience: If all of a school’s vendors are integrated via OAuth SSO, then Veracross users only need to manage one account. (Note: Veracross OAuth SSO will work for all Veracross account types, including MFA, Google Accounts, and school domain accounts). 
• Security: No user passwords are shared to vendors. Vendors also benefit from Veracross' pre-existing security infrastructure.
• History: All logins via OAuth SSO are tracked in the Login Log.

To view documentation for setting up your own OAuth application, navigate to one of the links below based on your role:

• Creating an OAuth Application: School Workflow
• Creating an OAuth Application: Vendor Workflow

How It Works

At a high level, Veracross OAuth SSO allows users at a school to log in to vendor websites with their existing Veracross account. OAuth, in short, is a “protocol for passing authorization from one service to another without sharing the actual user credentials” (from this informative Cloudflare introductory post on OAuth). Because of this design pattern in OAuth, this SSO functionality is built on top of OAuth 2.0. 

The key part of OAuth SSO is the authorization request. By combining different elements of the OAuth Application (Scopes, Redirect URI, and the “client id” of the OAuth Application) and passing these elements through the Veracross Login page, Veracross is able to validate authorization requests for specific apps. 
 
The properties included in this URL aren’t secret, and are accessible from the OAuth Application record: 

An example of an OAuth application record.  Query these records using the OAuth Applications query on the Identity and Access Management homepage. 

Clicking the Authorization URL link brings you to the recognizable Veracross Login page. The OAuth Application name is shown at the top, which helps inform users that they will be redirected to the vendor application after login: 

A Veracross login screen.

Successful login will send the user to the vendor’s website. From this point on, the vendor is responsible for the user experience. This login activity will also be saved to the Login Log for future reference. 

Note: unlike most public OAuth implementations (eg, “Log In with Facebook”, “Log In with Pinterest”, etc), Veracross users won’t see a separate “approval” screen. This is intentional. For Veracross users, SSO to a vendor website is pre-approved by the setup of the OAuth Application, and no separate approval from end users is necessary.

Supplemental Security Role: OAuth_App_Admin

Veracross has a supplemental security role (OAuth_App_Admin) to enable creating, updating, and deleting OAuth Applications. Users with this security role have full access to OAuth Application records in Axiom.