Authentication Concepts

How authentication works in Autional — from password hashing to OIDC flows.

Password Transmission Modes

Autional supports 4 password transmission modes, configurable per tenant:

Mode	Security	Use Case
plain	Low	Local development, trusted network
hash	Medium	Standard SaaS, HTTPS required
symmetric	High	ECDH key exchange + AES-256-GCM
asymmetric	Highest	RSA-OAEP, for regulated industries

Password Hashing (Server-Side)

After transmission, passwords are hashed with argon2id (KDF) + PASSWORD_PEPPER. The system also keeps bcrypt as a fallback for legacy data and supports per-tenant algorithm selection.

Session & Token Flow

User Login → POST /auth/login
  ├─ Returns: access_token (JWT, 5min) + refresh_token (24h)
  ├─ Access token: sent as Authorization Bearer header
  ├─ Refresh: POST /auth/refresh → new token pair
  └─ Logout: POST /auth/logout → revoke tokens, blacklist

OAuth 2.1 / OIDC

Autional implements the full OAuth 2.1 + OpenID Connect provider stack:

Authorization Code + PKCE (RFC 7636)
Client Credentials (M2M)
Device Authorization (RFC 8628)
Token Exchange (RFC 8693) — NHI and AI agent authentication
DPoP (Demonstrating Proof of Possession)
JARM (JWT-Secured Authorization Response)
Dynamic Client Registration (RFC 7591)
Rich Authorization Request (RFC 9396)

SAML 2.0

Enterprise single sign-on (SSO) via SAML 2.0 IdP, with metadata exchange, SLO, and attribute mapping. Configured through the admin console.

Standards & References

Autional's authentication stack implements the following published standards: