The Workflow Engine requires details about user objects and attributes that it requires to execute a workflow. It uses Oauth-based authentication to communicate with Identity Applications. It validates the requests it receives from known clients like Identity Applications.
Identity Applications use their own client credentials to authenticate to the Workflow Engine.
The Workflow Engine authenticates to Identity Applications through client credentials. It uses client credentials to generate an OSP token and then uses that token while running Identity Manager role and resource tasks to perform role or resource requests through REST service.