Satu akun untuk semua aplikasi BATAS Group
HRIS, ATS, dan aplikasi internal lain memakai satu master user di sini. Cukup login sekali, aplikasi lain memverifikasi lewat token ID/access yang ditandatangani RS256.
Issuer: https://sso.batas.study
Endpoint
Semua aplikasi internal mendaftarkan redirect_uri ke admin SSO, lalu memakai endpoint di bawah.
| Fungsi | URL | Catatan |
|---|---|---|
| Discovery | https://sso.batas.study/.well-known/openid-configuration | Metadata OIDC (RFC 8414) |
| Authorization | https://sso.batas.study/authorize | Authorization Code + PKCE (S256) |
| Token | https://sso.batas.study/token | authorization_code & refresh_token |
| UserInfo | https://sso.batas.study/userinfo | Klaim profil via Bearer token |
| JWKS | https://sso.batas.study/.well-known/jwks.json | Kunci publik RS256 |
| Logout | https://sso.batas.study/logout | RP-initiated logout |
Contoh integrasi (resource server)
# 1) Arahkan user ke authorization endpoint GET https://sso.batas.study/authorize ?response_type=code &client_id=batas-ats &redirect_uri=https://ats.batas.study/api/auth/callback &scope=openid%20profile%20email &state=abc123 &code_challenge=<S256>&code_challenge_method=S256 # 2) Tukar code menjadi token POST https://sso.batas.study/token grant_type=authorization_code&code=...&redirect_uri=...&code_verifier=... # 3) Ambil profil GET https://sso.batas.study/userinfo Authorization: Bearer <access_token>