OIDC Authentication

Authentication Mechanism

MetaEdge supports the OIDC (OpenID Connect) standard authentication flow:

1. Authorization: GET /oauth2/authorize — Validates client_id/redirect_uri, redirects (302) to the external authorization page
2. User Consent: POST /oauth2/authorize/consent — After the user logs in and consents, generates a one-time authorization code stored in Redis
3. Token Exchange: POST /oauth2/token — Exchanges authorization_code + PKCE code_verifier for a device_token
4. Internal Token to device_token: POST /oauth2/authorize (POST) — Exchanges an internal business-server access_token for a Meta Edge device_token

device_token: RS256-signed JWT containing standard OIDC claims.

Verification Public Key: GET /.well-known/jwks.json — Returns an RSA public key JWK set, supporting key rotation.

OIDC Discovery: GET /.well-known/openid-configuration — Returns issuer, endpoint list, supported algorithms, and claims.

Additionally, traditional email + password login is supported:

1. POST /user/login-with-password — Validates password; returns whether 2FA is required and a one-time login ticket
2. POST /user/login/2fa — Second-factor verification (EMAIL / AUTHENTICATOR); issues access_token + device_token upon success

Response Format: All endpoints return a unified structure { "code": 0, "msg": "success", "data": ... }.