Application Management

What is an Application?

An Application in Orion represents any service, website, or API that needs to authenticate users or make authenticated requests. Applications belong to an Organisation and serve as the primary unit of configuration for authentication, authorization, and OAuth.

Key properties of an application:

• Name — Human-readable display name
• PublicId — A GUID that uniquely identifies the application. Also serves as the OAuth client_id.
• Description — Shown to users during permission/consent screens
• IsAutoRegister — Whether users are automatically granted access without explicit permission
• IsRoamingEnabled — Whether users from other organisations can authenticate
• IsDiscoverable — Whether the app appears in the Application Directory
• IsOAuthEnabled — Whether OAuth 2.0/OIDC is active for this application

Creating Applications

Applications are created via the Management UI by organisation administrators.

Go to Account Manager → Manage Applications

Provide a name, description, and select the required permission policy (what data the app needs access to).

• Enable Auto Register if you want all org users to have automatic access
• Enable Roaming if users from other organisations should be able to authenticate
• Enable Discoverable to list the app in the organisation directory

After creation, note the PublicId shown in the Application Manager. This is your client_id for OAuth and the ApplicationId for the SDK.

Enabling OAuth

OAuth is configured per application. To enable it:

Go to Applications → click on your app.

Check the "Enable OAuth" checkbox in the OAuth section.

• Redirect URIs: Space-separated list of allowed redirect URIs for the authorization code flow
• Post-Logout Redirect URIs: Where to redirect after end_session
• Allowed Grant Types: Which grant types this client can use (space-separated)
• Allowed Scopes: Which scopes this client can request
• Require PKCE: Whether PKCE is mandatory (recommended: yes)
• Require Consent: Whether users see a consent screen
• Access Token Lifetime: Seconds until the access token expires
• Refresh Token Lifetime: Seconds until the refresh token expires

For server-side applications, generate a client secret. The secret is shown only once — store it securely.

System Accounts

System accounts provide machine-to-machine authentication for your application. Each system account has a Public Key and a Secret Key used for HMAC authentication.

Creating a System Account

In the Application Manager, click Generate New System Account. Both keys are shown immediately — the secret key is only displayed once.

// Example keys (for illustration only)
Public Key:  a1b2c3d4-e5f6-7890-abcd-ef1234567890
Secret Key:  LXg0YTFiMmMzZ...base64...encoded

Cross-Application Permissions

By default, a system account can only access data within its own application. To grant access to other applications, use Manage Permissions on the system account and grant access to the target application.

Redirect URI Configuration

Redirect URIs are validated during the OAuth authorization flow to prevent open redirect attacks.

• Exact match: By default, redirect URIs must match exactly (including path, no query string).
• Multiple URIs: Space-separate multiple URIs in the configuration field.
• Wildcard domains: If ORION_ALLOWED_REDIRECT_DOMAINS is set, redirect URIs matching those patterns are allowed server-wide.
• Localhost: http://localhost URIs are accepted during development (any port).

Permission Policies

Each application has a permission policy that defines what data access the application requires. Users must accept this policy before they can access the application.

• Policies are versioned — changing requirements creates a new policy version
• When a policy is updated, all existing permission grants are revoked and users must re-consent
• Policies are shown to users during the permission grant screen

Application Directory

The Application Directory (Account Manager → App Directory) shows all discoverable applications across all organisations. Organisation administrators can use this to:

• Browse available applications
• Grant system account permissions to third-party applications
• View application details and permission requirements

To make your application appear in the directory, enable Discoverable in the application settings.