Authentication and authorization

CFT services should use OpenID Connect with CFT IDAM for user authentication.

Authentication and authorization are separate concerns. OpenID Connect establishes the user identity. Services are responsible for their own authorization decisions.

OpenID Connect flows

Use the authorization code flow for browser-based user authentication.

Use PKCE where the client stack supports it.

Use client credentials only for service-to-service authentication where no user is involved.

Avoid password and implicit grants for new integrations.

For implementation guidance, see the OpenID Connect Guide for CFT Developers Using CFT IDAM.

This page was last reviewed on 8 June 2026. It needs to be reviewed again on 8 June 2027 by the page owner platops-build-notices .