ores.iam.login_messages
Table of Contents
- 1. Includes
- 2. Messages
- 2.1. party_summary
- 2.2. login_request
- 2.3. login_response
- 2.3.1. success
- 2.3.2. account_id
- 2.3.3. tenant_id
- 2.3.4. tenant_name
- 2.3.5. username
- 2.3.6. email
- 2.3.7. password_reset_required
- 2.3.8. tenant_bootstrap_mode
- 2.3.9. party_setup_required
- 2.3.10. party_setup_warning
- 2.3.11. token
- 2.3.12. error_message
- 2.3.13. message
- 2.3.14. selected_party_id
- 2.3.15. available_parties
- 2.3.16. default_party_id
- 2.3.17. access_lifetime_s
- 2.3.18. session_id
- 2.4. logout_request
- 2.5. logout_response
- 2.6. public_key_request
- 2.7. refresh_request
- 2.8. refresh_response
- 2.9. service_login_request
- 2.10. service_login_response
The login protocol messages.
1. Includes
#include <string> #include <vector>
2. Messages
2.1. party_summary
2.1.1. id
2.1.2. name
2.1.3. party_category
2.1.4. business_center_code
2.2. login_request
2.2.1. principal
2.2.2. password
2.3. login_response
2.3.1. success
2.3.2. account_id
2.3.3. tenant_id
2.3.4. tenant_name
2.3.5. username
2.3.6. email
2.3.7. password_reset_required
2.3.8. tenant_bootstrap_mode
2.3.9. party_setup_required
2.3.10. party_setup_warning
/** * @brief Set when the party provisioner wizard has completed * (onboarding.party = true) but the party is still Inactive. The * client should show a message instead of re-launching the wizard. */
2.3.11. token
2.3.12. error_message
2.3.13. message
2.3.14. selected_party_id
2.3.15. available_parties
2.3.16. default_party_id
/** * @brief The account's stored default party, if set and among * @c available_parties. Empty when unset. Only meaningful when * @c selected_party_id is empty (multi-party login, picker step). */
2.3.17. access_lifetime_s
/** * @brief Token lifetime in seconds as configured on the server. * * Clients use this to arm the proactive refresh timer so that the * timer interval tracks any server-side configuration changes. */
2.3.18. session_id
/** * @brief The IAM session UUID created for this login. * * Matches the session record in ores_iam_sessions_tbl. Clients should * forward this as Nats-Session-Id on every subsequent request so that * all calls from a single login session can be correlated in logs. */
2.4. logout_request
2.5. logout_response
2.5.1. success
2.5.2. message
2.6. public_key_request
2.7. refresh_request
/** * @brief Request to refresh a JWT token. * * The current token is passed in the Authorization: Bearer header. * No request body is needed — identity is taken from the token claims. */
2.8. refresh_response
/** * @brief Response to a token refresh request. */
2.8.1. success
2.8.2. token
2.8.3. message
2.8.4. access_lifetime_s
/** * @brief Token lifetime in seconds for the newly issued token. * * Clients re-arm the proactive refresh timer using this value. */
2.9. service_login_request
/** * @brief Authenticates a service account and issues a JWT. * * Service accounts cannot log in with the regular password-based login path. * They authenticate by presenting their database user password (which is * stored as a SHA-256 hash in the service account row). On success the IAM * service creates a session and returns a short-lived RS256 JWT identical in * structure to a human login token. * * The @p username must match the @c username column of an existing service * account (i.e. the database user name such as "ores_local1_reporting_service"). * The @p password is the plaintext database password for that user. */