-: [Instructor} Now that we understand
stateless authentication,
we can understand how we can do single sign-on
using stateless authentication.
So here, what we can do is any client,
like a web client or a mobile client,
if they're connecting to our system for the first time,
they'll be routed to the authorization service,
and authorization service will provide them a token.
So let's say, this is the value of the token,
here it's an arbitrary value,
but we will discuss what exactly goes inside a token.
So right now, consider this as a token.
So if now this mobile client has to
connect to any of the service within our system,
it can directly go to this gateway service.
It doesn't need to necessarily go to our web application
like we did for stateful authentication.
Similarly, this browser client can also go
to any application.
I mean, it can't have any access point to our system
just that it is a browser client,
So it makes sense to have web application
as the access point.
But let's say if we are doing any Ajax call
within our browser,
we can also go to the gateway service directly
for a restful call,
And possibly if we want to directly go to a service,
and that can be a case,
let's say we have an internal application
and we directly want to access any of the service,
And if our client has the token,
then it can directly access these services.
So once we have the token,
we can directly access these services
and these services will do the validation of that token.
They will extract authentication
and authorization information out of that.
The way the token is transported among REST application
or rest clients is that they use authorization header
in their HTTP request,
and in authorization header,
they indicate that they are going to use a bearer token.
We will later see what are the different types of token.
But this is the commonly used token,
which means that whoever is holding this token,
has access to the application as specified,
by the role contained in the token.
So this is how we move around the token,
whenever we are accessing any restful service.
If we are accessing a web application,
we can use this scheme with any JavaScript or ajax call.
Otherwise, if we are trying to access the system
using hyperlinks on a webpage,
then we can pass this token as part of a cookie.
So regardless of how we can pass this token around,
as long as we can provide the token
to a service which is capable
of doing stateless authentication,
we can achieve single sign-on.