anchor.diff:  owner: Identity
   ---
   
  -
  -
   This topic provides an overview of the User Account and Authentication (UAA) Server, the identity management service for <%= vars.app_runtime_full %>.
   
  +
   ## <a id="overview"></a> Overview
   
  -The primary role of the UAA is as an OAuth2 provider, issuing tokens for client apps to use when they act on behalf of <%= vars.product_short %> users.
  -In collaboration with the login server, the UAA can authenticate users with their <%= vars.product_short %> credentials, and can act as an SSO service using those, or other, credentials.
  -
  -The UAA has endpoints for managing user accounts and for registering OAuth2 clients, as well as various other management functions.
  -
  -## <a id='quickstart'></a>Quick Start ##
  -
  -You can deploy the UAA locally or to <%= vars.product_short %>.
  -
  -* [Deploy UAA Locally](#local)
  -* [Deploy UAA to <%= vars.product_short %>](#cf)
  -
  -### <a id='local'></a>Deploy UAA Locally ###
  -
  -Follow the instructions below to deploy and run the UAA locally.
  -
  -1. In a terminal window, clone the UAA GitHub repository. 
  -
  -    <pre class="terminal">
  -    $ git clone git://github.com/cloudfoundry/uaa.git
  -    </pre>
  -
  -2. Navigate to the directory where you cloned the UAA GitHub repository, then run the `./gradlew run` command to build and run all the components that
  -comprise the UAA and the example programs, `uaa`, `samples/api`, and `samples/app`.
  -
  -    <pre class="terminal">
  -    $ cd uaa
  -    $ ./gradlew run
  -    </pre>
  -
  -3. If successful, the three apps run together on a single instance of Tomcat
  -listening on port 8080, with endpoints `/uaa`, `/app`, and `/api`.
  -
  -### <a id='demo-local'></a>Use Local UAA ###
  -
  -Follow the steps below to access and use a locally-deployed UAA server.
  -
  -1. Run the UAA server as described in the [Deploy Locally](#local) section, above. 
  -
  -2. Open another terminal window. From the project base directory, run `curl localhost:8080/uaa/info -H "Accept: application/json"` to confirm the UAA is running. You should see basic information about the system. For example:
  +The primary role of UAA is as an OAuth2 provider, issuing tokens for client apps to use when they act on behalf of <%= vars.product_short %> users. In collaboration with the login server, UAA can authenticate users with their <%= vars.product_short %> credentials, and can act as an SSO service using those, or other, credentials.
  +
  +UAA has endpoints for managing user accounts and for registering OAuth2 clients, as well as various other management functions.
  +
  +Different runtimes and services use separate UAA instances. Pivotal Application Service (PAS) has two UAA instances by default: one for BOSH Director, used to bootstrap the rest of the <%= vars.product_name %> deployment; and one for the BOSH deployment, used as a shared resource by all apps that require user authentication. This is the minimum number of UAA instances PAS must have. Pivotal Container Service (PKS) and Concourse also have UAA instances. These instances are separate from each other. If you log into one runtime or service, you are not also logged into other runtimes and services that authenticate using UAA. You must log into each runtime or service separately.
  +
  +
  +## <a id='quickstart'></a> Quick Start
  +
  +You can deploy UAA locally or to <%= vars.product_short %>.
  +
  +### <a id='local'></a> Deploy UAA Locally
  +
  +To deploy and run UAA locally:
  +
  +1. In a terminal window, clone the UAA GitHub repository by running: 
  +
  +    ```
  +    git clone git://github.com/cloudfoundry/uaa.git
  +    ```
  +
  +1. Navigate to the directory where you cloned the UAA GitHub repository.
  +
  +1. To build and run all the components that comprise UAA and the example programs `uaa`, `samples/api`, and `samples/app`, run:
  +
  +    ```
  +    ./gradlew run
  +    ```
  +
  +1. If successful, the three apps run together on a single instance of Tomcat listening on port 8080, with endpoints `/uaa`, `/app`, and `/api`. Tomcat is a library of Java code used by UAA to create its features. For more information, see the [Apache Tomcat](http://tomcat.apache.org/) website.
  +
  +### <a id='demo-local'></a> Use Local UAA
  +
  +To access and use a locally-deployed UAA server:
  +
  +1. Run the UAA server as described in [Deploy Locally](#local). 
  +
  +1. Open another terminal window. From the project base directory, run `curl localhost:8080/uaa/info -H "Accept: application/json"` to confirm the UAA is running. You should see basic information about the system. For example:
   
       <pre class="terminal">
       $ curl localhost:8080/uaa/info -H "Accept: application/json"
  
positive.code: 
  Profile names can be hyphenated to indicate multiple contexts. For example, `local-vcap` can be used when the login server is in a different location than the UAA server.
  
  ##### Use Cases #####
  
  1. See all apps:
  
          GET /app/apps
  
      Browser is redirected through a series of authentication and access grant steps, and then the photos are shown.
  
  2. See the currently logged in user details, a selection of attributes from the OpenID provider:
  
          GET /app
  
  #### <a id='login-application'></a>LOGIN App ####
  
  The `login` app is a user interface for authentication. 
  The UAA can also authenticate user accounts, but only if it manages them itself,
  and it only provides a basic UI.
  You can brand and customize the login app for non-native authentication and for more complicated UI flows, like user registration and password reset.
  
  The login app is itself an OAuth2 endpoint provider, but delegates those features to the UAA server.
  Therefore, configuration for the login app consists of locating the UAA through its OAuth2 endpoint URLs and registering the login app itself as a client of the UAA.
  A `login.yml` for the UAA locations exists, such as for a local `vcap` instance:
  
  ```yaml
  uaa:
    url: http://uaa.vcap.example.net
    token:
  
negative.code:       scope: clients.read clients.secret clients.write uaa.admin clients.admin scim.write scim.read
        jti: 19f25e6ca9cc4eb2a7f5016e441ce8d4
      </pre>
      Copy the access token from this output for the following step.
  
  1. Run `uaac token decode ACCESS-TOKEN-VALUE` to view information in the token, which is encoded using the JSON Web Token (JWT) format. Replace `ACCESS-TOKEN-VALUE` with your access token, copied from the `uaac context` output. The UAAC should display all the claims inside the token body. For example:
  
      <pre class="terminal">
      $ uaac token decode eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiIxOWYyNWU2Y2E5Y2M0ZWIyYTdmNTAxNmU0NDFjZThkNCIsInN1YiI6ImFkbWluIiwiYXV0aG9yaXRpZXMiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInNjaW0ud3JpdGUiLCJzY2ltLnJlYWQiXSwic2NvcGUiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInNjaW0ud3JpdGUiLCJzY2ltLnJlYWQiXSwiY2xpZW50X2lkIjoiYWRtaW4iLCJjaWQiOiJhZG1pbiIsImF6cCI6ImFkbWluIiwiZ3JhbnRfdHlwZSI6ImNsaWVudF9jcmVkZW50aWFscyIsInJldl9zaWciOiIyNjcxOTlkMSIsImlhdCI6MTUyODIzMjAxNywiZXhwIjoxNTI4Mjc1MjE3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvdWFhL29hdXRoL3Rva2VuIiwiemlkIjoidWFhIiwiYXVkIjpbInNjaW0iLCJjbGllbnRzIiwidWFhIiwiYWRtaW4iXX0.L2cn6HqLQAEyqTrYYkL9Al_8JyfwB330er7DshUb9wg
  