Federated authentication in GraphQL - Step-by-Step Execution

Concept Flow - Federated authentication

User tries to access app

↓

App redirects to Identity Provider (IdP)

↓

User logs in at IdP

↓

IdP sends token to app

↓

App verifies token

↓

Access granted if token valid

↓

User accesses resources

User tries to log in, app sends them to a trusted identity provider. After login, the provider sends a token back. The app checks the token and grants access if valid.

Execution Sample

GraphQL

query GetUserData {
  user {
    id
    name
    email
  }
}

A GraphQL query to get user data after federated authentication is successful.

Execution Table

Step	Action	Input/Condition	Output/Result
1	User requests access	User opens app	App redirects to IdP login page
2	User logs in	User enters credentials at IdP	IdP authenticates user
3	IdP sends token	User authenticated	Token sent to app
4	App verifies token	Token received	Token valid? Yes
5	App executes GraphQL query	Valid token	User data returned
6	User accesses resources	User data received	Access granted

💡 Process stops if token is invalid or user cancels login

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
user_authenticated	false	true	true	true	true
token	null	null	token_string	token_string	token_string
access_granted	false	false	false	true	true

Key Moments - 2 Insights

Why does the app redirect the user to the Identity Provider instead of asking for credentials directly?

Because the app trusts the Identity Provider to handle authentication securely. This is shown in execution_table step 1 where the app redirects to IdP.

What happens if the token sent by the Identity Provider is invalid?

The app will not grant access and the process stops. This is implied in the exit_note and step 4 where token validity is checked.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the app receive the token?

A Step 3

B Step 4

C Step 2

D Step 5

💡 Hint

Check the 'Action' and 'Output/Result' columns in execution_table row for Step 3

According to variable_tracker, when does 'access_granted' become true?

A After Step 3

B After Step 4

C After Step 2

D At Start

💡 Hint

Look at the 'access_granted' row and see when it changes from false to true

If the token was invalid, what would happen to 'user_authenticated' in variable_tracker?

A It would become true

B It would become null

C It would remain false

D It would be removed

💡 Hint

user_authenticated becomes true after Step 2 when IdP authenticates, before token verification. See variable_tracker.

Concept Snapshot

Federated authentication lets users log in via a trusted external provider.
The app redirects users to the provider for login.
The provider sends back a token after successful login.
The app verifies the token before granting access.
This keeps user credentials safe and centralized.

Full Transcript

Federated authentication is a process where a user tries to access an app, which then redirects the user to a trusted identity provider for login. The user enters credentials at the identity provider, which authenticates the user and sends back a token to the app. The app verifies this token and if valid, grants access to the user. This process ensures secure login without the app handling user passwords directly. The GraphQL query example shows how after authentication, the app can request user data securely. Variables like user_authenticated and access_granted track the login state. If the token is invalid, access is denied and the process stops.