Skip to main content
Identity and Access Management (IAM) 

User Authentication Guidelines

Applications that require user authentication (SSO) must conform with the following policies. Any deviation must be approved by the Identity Team before proceeding.

New Application Requirements

Basic User Authentication

New applications that do not need to call existing Tyk/Hydra APIs should use the OIDC protocol through Okta. OIDC is the preferred protocol. Applications may use the SAML protocol through Okta if there is a compelling reason.

 Accessing Existing APIs

New applications that need to call existing Tyk/Hydra APIs should use Tyk/Hydra user authentication. [User authentication will be migrated from Tyk/Hydra but that migration has not been scheduled.]

Migrating Existing Applications from the CAS IdP to Okta

Applications Using the CAS Protocol

Existing applications using the CAS protocol on the CAS IdP must switch to either OIDC or SAML on Okta (the CAS protocol is not available on Okta). OIDC is the preferred protocol.

Applications Using the SAML Protocol

Existing applications using SAML on the CAS IdP may migrate to SAML or OIDC on Okta.

Applications Using Tyk/Hydra Only to Authenticate Users

Existing applications using Tyk/Hydra only to authenticate users may continue to use Tyk/Hydra until user authentication on Tyk/Hydra migrates to Okta. [That migration has not been scheduled.]

Applications Using Tyk/Hydra to Authenticate Users and Call APIs

Existing applications using Tyk/Hydra to authenticate users and call APIs may continue to use Tyk/Hydra until all the APIs they use that require Tyk/Hydra tokens are either replaced, deprecated, or retired. [The work to deprecate those APIs has not been scheduled.]

Applications Using Tyk/Hydra Only to Call APIs

Existing applications using Tyk/Hydra to authenticate only to call APIs can continue to use Tyk/Hydra until all the APIs they use that require Tyk/Hydra tokens are either replaced, deprecated, or retired. [The effort to deprecate those APIs has not been scheduled.]

Tyk/Hydra Changes

  1. Tyk will be federated to Okta rather than CAS. [The date has not been scheduled.]
  2. Okta will replace Hydra as the provider for OAuth 2 services. Use of Okta OAuth 2 services will begin now and APIs will be migrated. [The work and date for migrating APIs has not been scheduled.]
  3. When the changes are complete, Tyk will not mediate calls to Okta. Applications may call Okta authentication APIs directly.

There is no need to migrate user authentication and API authentication at the same time.