GajuPassport
I create the experience.
I am the application the resource owner chooses to use. I coordinate the browser redirects, request the smallest useful permissions, and turn authorised registry data into a useful interface.
My point of view
Database-free client
There are no Passport administrators to log in.
GajuPassport has no database and stores no administrator accounts. It participates as an OAuth2 client and does not provide a database-backed admin login.
My part of the conversation
What passes through my boundary.
I receive
- The resource owner's decision to sign in
- A one-time authorisation code from GajuAuth
- Scoped profile data returned by GajuRegistry
I am responsible for
- Generate a protected OAuth2 authorisation request
- Send the browser to GajuAuth for authentication and consent
- Exchange the returned code securely for an access token
- Call GajuRegistry only for the access the resource owner approved
I send
- An authorisation request to GajuAuth
- A token-authenticated API request to GajuRegistry
- A clear, useful identity experience to the resource owner
My lifecycle
What I do, in order.
Each hand-off has a narrow purpose. I complete my checks before authority or protected information moves to the next participant.
-
1
Prepare the request
Generate state and request only the scopes needed for the current experience.
-
2
Redirect the browser
Send the resource owner to GajuAuth so identity proof and consent happen on the authority's origin.
-
3
Handle the callback
Verify state, accept the short-lived code, and exchange it through the appropriate protected channel.
-
4
Use delegated access
Present the access token to GajuRegistry and turn the approved response into a useful interface.
Objects I handle
The artifacts have boundaries too.
Each item carries a particular meaning. None should be treated as unlimited proof, permission, or identity.
- State
- A client-generated correlation value that protects the redirect flow and connects the callback to its initiating session.
- Requested scopes
- The smallest set of named permissions the experience needs from GajuRegistry.
- Authorisation code
- The one-time result returned to the registered callback after approval.
- Access token
- Delegated authority used only with its intended resource server and within its lifetime.
Security outcomes
What my checks guarantee.
- Identity proof stays on GajuAuth
- The callback is correlated to the initiating session
- Only approved scopes are exercised
- Tokens are not treated as broader identity records
Where I stop
A deliberate boundary.
I never receive the resource owner's private key and I cannot expand the permissions encoded in my token.