Skip to main content

Concepts

You have signed a person in, and now you want to know why it worked. These seven pages explain the ideas behind it, one at a time. Each is short, starts from a small story, and has one diagram you can come back to.

If you read them in order, each one leans on the one before.

  1. Tenants: one organisation's own space, kept apart from every other.
  2. Clients: the apps that may ask people to sign in, and how they prove who they are.
  3. Scopes: the names an app uses to say what it wants, and a person to say what they allow.
  4. Roles and groups: how a person comes to hold a role, and why the roles and groups claims differ.
  5. Sessions: how long a sign-in lasts, how it ends, and what recovery codes are for.
  6. Tokens: the access, ID and refresh tokens, and what happens when one is used twice.
  7. Consent and audit: what a person agreed to share, and the record of what happened.

When Odudu says no, it tells a person, a client or an admin tool in the way each can use. Read a refusal shows seven of them.

To do something rather than understand it, start with the guides. To look up an exact setting or address, go to the reference.