Performing the policyauth grant

Edit online

The policyauth flow is the only grant type that uses first-factor rules.

Initiating the flow

Perform this initial request.
POST https://securitypoc.ice.ibmcloud.com/v1.0/endpoint/default/token

client_id=1a4310d4-0118-4511-9082-39669ccdcad6&
client_secret=cmVkYWN0ZWQ&
scope=openid&
grant_type=policyauth&
context=eyJzZXNzaW9uSWQiOiJNRE5qWm1RM05ETTJOakZtTURjNU56Vm1ZVEptTVQiLCAiaXBBZGRyZXNzIjoiMTkyLjE2OC4xLjEiLCAidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODMuMC40MTAzLjExNiBTYWZhcmkvNTM3LjM2In0=
The unencoded context parameter is 
{
        "sessionId":"MDNjZmQ3NDM2NjFmMDc5NzVmYTJmMT",
        "ipAddress":"192.168.1.1",
        "userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36"
}
Note: The access token has the ISV entitlements authnAnyUser because a user subject is not established for this grant.
The response is 
{
    "access_token": "Zm51m36StosiS1Ylk8N0kPej6txyqD77Csqu2BXx",
    "allowedFactors": [
        "password"
    ],
    "scope": "mfa_challenge",
    "grant_id": "c14c63c1-6431-4c8f-a8fe-c939aff01744",
    "token_type": "Bearer",
    "expires_in": 1800
}
If the context that is presented does not match the IP condition, the response is 
{
    "access_token": "0IINSucs0dv7Tj8uLEvZ1ePrwlkDV1O5dIK5UGJA",
    "allowedFactors": [
        "fido2"
    ],
    "scope": "mfa_challenge",
    "grant_id": "8edae448-b6a8-4ae7-8ebb-63c2a9a49ca0",
    "token_type": "Bearer",
    "expires_in": 1800
}
Take note of the difference in the allowedFactors that was returned.

Performing a first factor

Using the allowedFactors that was indicated, a call to the username password API is performed.
POST https://securitypoc.ice.ibmcloud.com/v1.0/authnmethods/password/46872982-ab9e-4c9f-8200-8f394b328394?returnJwt=true
Authorization: Bearer Zm51m36StosiS1Ylk8N0kPej6txyqD77Csqu2BXx


{
  "username": "scott",
  "password": "hunter22"
}
The access token that was issued in the mfa_challenge response is used to invoke factors. The endpoint invocation includes the returnJwt parameter.
The response is 
{
  "groups": [...],
  "attributes": [...],
  "assertion": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNlcnZlciJ9.eyJzdWIiOiI2MDQwMDAzT0g4IiwianRpIjoiNjBmMDY3ZDYtM2VmYS00ODVlLTk0MTYtMzZjNjQ4MTFhZTc2IiwiaWF0IjoxNTkzNDkyOTA0LCJleHAiOjE1OTM0OTMyMDQsInRlbmFudElkIjoibG1mLmljZS5pYm1jbG91ZC5jb20iLCJpc3MiOiJodHRwczovL2xtZi5pY2UuaWJtY2xvdWQuY29tL3YyLjAvZmFjdG9ycyIsImF1ZCI6WyIxYTQzMTBkNC0wMTE4LTQ1MTEtOTA4Mi0zOTY2OWNjZGNhZDYiLCJodHRwczovL2xtZi5pY2UuaWJtY2xvdWQuY29tL3YxLjAvZW5kcG9pbnQvZGVmYXVsdC90b2tlbiJdLCJmYWN0b3IiOiJwYXNzd29yZCIsImFtciI6WyJwYXNzd29yZCJdLCJncmFudF9pZCI6ImMxNGM2M2MxLTY0MzEtNGM4Zi1hOGZlLWM5MzlhZmYwMTc0NCJ9Cg.J9_Omrs8vlTz9bgGWVI0T4AssoMP0UFNoDZ_4d93NEELq_kE1qoXw0Ao8_1QMyyYPRhtnCxtpF5NrD7s4yIzU-WnOkV2qXHfVX5nZPJnPOdP3YOOfUiA0sBTqxlAWr_lePaZuMjseKXpB0YP9ntOqo9T0woQ9MUY6B1gPrRbnX9Zzx64RzA3GgUD3_IhgghIcwxYuSZEKzf8PejG-oh70jSE5gkPK8JiEbvc2lVP7tQgdTCdbjRFybST5B57RTdU1X85uQ7fjO4ggxLcYljHPBfOkSgwCBnq6BXwcVo8o4w6XPYQgRnjDFyJJTf7EwLMaoEwjDiGO4wHXmATgitMng",
  "id": "6040003OH8"
}

Initial authentication: presenting the JWT back to /token

POST https://securitypoc.ice.ibmcloud.com/v1.0/endpoint/default/token

POST https://securitypoc.ice.ibmcloud.com/v1.0/endpoint/default/token

client_id=1a4310d4-0118-4511-9082-39669ccdcad6&
client_secret=cmVkYWN0ZWQ&
scope=openid&
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&
context=eyJzZXNzaW9uSWQiOiJNRE5qWm1RM05ETTJOakZtTURjNU56Vm1ZVEptTVQiLCAiaXBBZGRyZXNzIjoiMTkyLjE2OC4xLjEiLCAidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODMuMC40MTAzLjExNiBTYWZhcmkvNTM3LjM2In0=&
assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6InNlcnZlciJ9.eyJhbXIiOlsiZW1haWxvdHAiLCJwYXNzd29yZCJdLCJhdWQiOlsiMWE0MzEwZDQtMDExOC00NTExLTkwODItMzk2NjljY2RjYWQ2IiwiaHR0cHM6Ly9zZWN1cml0eXBvYy5pY2UuaWJtY2xvdWQuY29tL3YxLjAvZW5kcG9pbnQvZGVmYXVsdC90b2tlbiJdLCJleHAiOjE1OTM4OTMyMDQsImZhY3RvciI6ImVtYWlsb3RwIiwiZ3JhbnRfaWQiOiJjMTRjNjNjMS02NDMxLTRjOGYtYThmZS1jOTM5YWZmMDE3NDQiLCJpYXQiOjE1OTM4OTI5MDQsImlzcyI6Imh0dHBzOi8vc2VjdXJpdHlwb2MuaWNlLmlibWNsb3VkLmNvbS92Mi4wL2ZhY3RvcnMiLCJqdGkiOiI2MGZhYjdkNi0zZWZhLTQ4NWUtOTQxNi0zNmM2NDgxMWFlNzYiLCJzdWIiOiI2MDQwMDAzT0g4IiwidGVuYW50SWQiOiJzZWN1cml0eXBvYy5pY2UuaWJtY2xvdWQuY29tIn0.J9_Omrs8vlTz9bgGWVI0T4AssoMP0UFNoDZ_4d93NEELq_kE1qoXw0Ao8_1QMyyYPRhtnCxtpF5NrD7s4yIzU-WnOkV2qXHfVX5nZPJnPOdP3YOOfUiA0sBTqxlAWr_lePaZuMjseKXpB0YP9ntOqo9T0woQ9MUY6B1gPrRbnX9Zzx64RzA3GgUD3_IhgghIcwxYuSZEKzf8PejG-oh70jSE5gkPK8JiEbvc2lVP7tQgdTCdbjRFybST5B57RTdU1X85uQ7fjO4ggxLcYljHPBfOkSgwCBnq6BXwcVo8o4w6XPYQgRnjDFyJJTf7EwLMaoEwjDiGO4wHXmATgitMng
The context parameter is unchanged.
The /token response is 
{
  "access_token": "lkXMx3tHQjWSalhNmtWIrloMHQOue1ntchRymytL",
  "allowedFactors": [
    "emailotp"
  ],
  "scope": "mfa_challenge",
  "grant_id": "c14c63c1-6431-4c8f-a8fe-c939aff01744",
  "token_type": "Bearer",
  "expires_in": 1799
}
Note: The grant_id remains constant because this usage is not the establishment of a new grant, unlike traditional jwt-bearer grant_type usage. The access token has the ISV entitlements 
authn,
        readEnrollMFAMethod
that allows for both factor enrollment discovery and execution.

Because the user is in the ADMINISTRATORS group, further authentication is required. See Performing Multi-Factor Authentication (MFA).