The Self-Service Portal application plugin is used to create a browser-based application that allows users to manage their accounts, e.g. view and edit their personal information, manage multi-factor authentication (MFA) settings, and manage authorizations granted to third-party applications. It is secure, as it uses the Token Handler pattern under the hood to protect access tokens. A Self-Service Portal application is a browser-based single page application (SPA) that uses these GraphQL APIs to communicate with the Curity Identity Server:
um-graphql-api
oauth-granted-authorization-graphql-api
The API access is authorized using the Self-Service Authorization Manager, which ensures that users can only access their own accounts.
Self-Service Portal applications are configured in an Application service profile, more specifically on the applications list. The following two figures illustrate listing and adding a Self-Service Portal application.
Fig. 45 Listing all applications.
Fig. 46 Adding a Self-Service Portal application.
Configuring a Self-Service Portal application is a fairly complex task, as it requires different components in the system to work together (e.g. profiles with GraphQL APIs, Authorization Manager, scopes and claims). To help with that there’s a setup wizard that guides administrators through the configuration steps. The wizard is divided into four steps:
Collecting all the necessary information to create a fully functional Self-Service Portal application. Show a summary of what will be created and allow administrators to review the configuration. Deploying required endpoints (if necessary), e.g. the um-graphql-api or the oauth-granted-authorization-graphql-api endpoint. Create the Self-Service Portal application and all the necessary resources.
Fig. 47 1st step to configure a Self-Service Portal application.
In the first step of the setup wizard, you are asked to provide the following information:
The summary of all resources that will be created is shown in the second step of the wizard.
Once a Self-Service Portal application is created, it can be further customized by editing the application. Notable settings include authorization and look & feel customization.
When a Self-Service Portal application is created, a unique instance of Self-Service Authorization manager is created and used. This authorization manager ensures that users can only access their own accounts. Additionally it controls which sections of the Self-Service Portal are available to users based on the configuration entered in the first step of the setup wizard. For example, it’s possible to disallow changing phone numbers, and this results not only in the proper authorization for the GraphQL APIs being used, but also in the Self-Service Portal application disabling/hiding the phone number update section in the UI. This configuration can be further customized by editing the application in the edit modal’s Authorization Manager Configuration section. Also Self-Service Authorization Manager provides more details on how to fine-tune the Self-Service authorization manager.
The Self-Service Portal web application can be customized to match the look and feel of an organization. A custom theme can be created under the System -> Look And Feel section. See Customize branding per Application for more details. Once a custom theme is created, it can be selected in the Self-Service Portal application edit modal (Template Area and Themes).
After a Self-Service Portal application is created, it can be accessed on this URL: <base-url>/<application-service-anonymous-endpoint>/<application-id>
<base-url>/<application-service-anonymous-endpoint>/<application-id>