Authentication Concepts

How authentication works in Autional — from password hashing to OIDC flows.

Password Transmission Modes

Autional supports 4 password modes, configurable per tenant:

Mode	Security	Use Case
plain	Low	Localhost dev, trusted network
hash	Medium	Standard SaaS, HTTPS required
symmetric	High	ECDH key exchange + AES-256-GCM
asymmetric	Highest	RSA-OAEP, regulated industries

Password Hashing (Server-Side)

After transmission, passwords are hashed with argon2id (KDF) + PASSWORD_PEPPER. The system also includes bcrypt fallback for legacy compatibility. Per-tenant algorithm selection is supported.

Session & Token Flow

User Login → POST /auth/login
  ├─ Returns: access_token (JWT, 30min) + refresh_token (24h)
  ├─ Access token: sent as Authorization Bearer header
  ├─ Refresh: POST /auth/refresh → new token pair
  └─ Logout: POST /auth/logout → revoke tokens, blacklist

OAuth 2.1 / OIDC

Autional implements the full OAuth 2.1 + OpenID Connect provider stack:

Authorization Code + PKCE (RFC 7636)
Client Credentials (M2M)
Device Authorization (RFC 8628)
Token Exchange (RFC 8693) — NHI and AI Agent auth
DPoP (Demonstrating Proof of Possession)
JARM (JWT-Secured Authorization Response)
Dynamic Client Registration (RFC 7591)
Rich Authorization Request (RFC 9396)

SAML 2.0

Enterprise SSO via SAML 2.0 IdP, with metadata exchange, SLO, and attribute mapping. Configured through the Admin Console.