...

Notes:  The Spark or WPE runtime loads the application.  The application that wants to use Thunder services creates the ThunderClient.  When the client is created, it requests a security token from the runtime.  The runtime then requests the token directly from the security agent through COM/RPC using the application context (the application's URL).  The security agent then creates and returns the token and returns it to the client.  As noted, the token is not returned back to the application that creates the Thunder client.  Once the application has created the Thunder Client, it then can invoke a service on a plugin... in this case Plugin1.foo().  The Thunder Client creates the request to Thunder by including the security token.  The Thunder Framework (not the actual plugin) checks with the security plugin to determine if the application can access this plugin based on the permissions file, and if so, allows the plugin to perform the request with the result being returned to the application.

Image Removed

Sending Security Token in JSON-RPC Requests

...