User Login & SSO
3 diagrams in this category.
OpenID Connect - Authorization Code Flow with PKCE
Recommended OIDC login flow where the client exchanges an authorization code for tokens and binds the exchange to a PKCE code verifier.
OpenID Connect - Implicit Flow
Legacy browser-based flow where tokens are returned directly in the redirect URI fragment. Deprecated in favour of Authorization Code + PKCE.
SAML 2.0 SP-Initiated SSO
A service provider redirects the user to an identity provider, which posts back a signed SAML assertion to establish a session.