Now that we understand statelets authentication, we can understand how we can do a single sign on using
statelets authentication.
So here, what we can do is any claim like of a plane or a mobile plane, if they're connecting to our
system for the first time, they'll be related to the authorization service and authorization service
will provide them a token.
So let's say that this is the value of the token here.
It's an arbitrary value, but we will discuss what exactly goes inside or token.
So right now, consider this as a token.
So if now this mobile flying has to connect to any of the service within our system, it can directly
go to this gateway service.
It doesn't need to necessarily go to our Web application like we did for stateful authentication.
Similarly, this browser client can also go to any application.
I mean, it can have any access point to our system, just that it has a browser client.
So it makes sense to have the application is the access point.
But let's say if we are doing any Ajax call within our browser, we can also go to the Gateway Service
directly for a restful call and possibly if we want to directly go to a service.
And that can be a case.
Let's say we have an internal application and we directly want to access any of the service.
And if our client has the token, then it can directly access these services.
So once we have the token, we can directly access these services and these services will do the validation
of that token.
They will extract authentication and authorization information out of that, the way the token is transported
among the rest application or arrest clients that they use authorization header in their request and
an authorization header.
They indicate that they are going to use a better token.
We will later see what are the different types of token.
But this is the commonly used token, which means that whoever is holding this token has access to the
application as specified by the rule contained in the token.
So this is how.
We move around the token whenever we are accessing any restful service, if we are accessing a Web application,
we can.
Use this scheme that any JavaScript or Ajax call otherwise, if we are trying to access the system using
hyperlinks on a webpage, then we can pass this token as part of a cookie.
So regardless of how we can pass this token around, as long as we can provide the token to a service
which is capable of doing statelets authentication, we can achieve single sign on.