Custom access tokens
Overview
Requests can be authorized with access tokens other than Sitefinity's OAuth2 tokens if necessary. Since Sitefinity CMS` authorization is based entirely on user accounts, only external identity providers that issue a unique user identifier can be used. The user must have logged into Sitefinity CMS at least once using the specific IP for its related local user account to have been created.
(A) The exact method of obtaining the token is up to the specific implementation and use case - it could be an OpenID Connect with OAuth2 flow or some other standardized or non-standardized protocol.
(B) The IP access token needs to be validated in Sitefinity CMS via custom code.
Sample validator
This sample show how to validate a custom access token issued by a generic OIDC.
Register the custom validator
Add the following code to the Global.asax file: