---
updatedAt: 2026-05-01T16:55:07.000Z
agentTools:
  projectIndex: https://developers.byallaccounts.morningstar.com/llms.txt
---

# 3. Authenticate Users

## Overview

User authentication is handled by the parent page before it invokes the Account Linking and Account Summary components. You will use the DataConnect API to authenticate users, regardless of user type.

## Instructions

> 🚧 Requirements for SSO
>
> * Administrator credentials for DataConnect API
> * The user identifier from [step 2](https://developers.byallaccounts.morningstar.com/docs/2-register-users)

### Authenticate investor users

1. Invoke a DataConnect API `<SESSIONAUTHRQ>` request, providing your Administrator credentials and passing the `Person Id` as `<PERSON_ID>` inside `<USER_IDENT>`, as shown [here](https://documenter.getpostman.com/view/23945043/2s9YJf1N3H#194e76c6-6306-43bd-ae9d-5b60f28d4811).

### Authenticate advisor users

1. Invoke a DataConnect API `<SESSIONAUTHRQ>` request, providing your Administrator credentials and passing the `<ID>` from registration as `<PERSON_ID>` inside `<USER_IDENT>`, as shown [here](https://documenter.getpostman.com/view/23945043/2sB3B8sDj5#7de4c546-19ca-4742-bd98-532ccb451dcc).

#### Notes

* For DataConnect operations in Postman, use “Send and Download” and save the result to a `.zip` file.  Inside that `.zip` file find the XML response which contains the `jsessionId` and `csrfToken` values.
* When you're done with an authenticated session, expire it using the DataConnect `<SESSIONEXPIRERQ>` operation, as shown [here](https://documenter.getpostman.com/view/23945043/2sB3B8sDj5#b9994e47-c333-4215-b18d-429eaf82da74).
* For more details about how the DataConnect API handles authentication, refer to the "Single Sign-on Operations" section of the [DataConnect API Guide](https://www.byallaccounts.net/Manuals/DataConnect/DataConnect_V4_Ultra_User_Guide.PDF).

> 👍 Success Criteria
>
> Upon success, you will have values for:
>
> * `jsessionId`
> * `csrfToken`
>
> Both must be passed to the components using the `auth-context` attribute in [step 6](https://developers.byallaccounts.morningstar.com/docs/6-incorporate-components-into-parent-page).

<br />