Configure API SSO
Last updated
Last updated
Cymmetri platform highly recommends adding support to either SAML 2.0 or OpenID Connect protocols owing to their well-accepted standards and to avoid vendor lock-in.
In the absence of the ability of the managed application to adopt either the SAML 2.0 or the OpenID Connect 1.0 standard, the Cymmetri Identity platform provides with the ability to integrate simple REST API based mechanism to allow an end-user to perform Single SignOn from the Cymmetri Identity Portal
User is assigned the application and clicks on the application tile.
The end user session is captured as the client IP address as received from the user’s browser.
The user session is validated and the Cymmetri Identity platform checks if the end user is authorised to perform Single SignOn into the managed application.
In case, such a session token is created and the end-user is redirected as a query parameter to an endpoint on the managed application.
The endpoint on the managed application also captures the end-user’s client IP address, and sends the received token to its backend.
The managed application backend already holds the Application ID and Application password assigned to it when the API-based SSO is configured on the Cymmetri Identity platform.
The managed application backend now makes a POST call to the validate token API endpoint exposed by the Cymmetri Identity platform with the form parameters as follows -
app_id - Previously shared application ID
app_pass - Previously shared application password
user_ip - End-user’s client IP address as captured from the end-user’s browser
auth_token - the token sent to the endpoint of the managed application.
The Cymmetri Identity platform responds back with a success message in case the application ID, application Password, client IP address and the user session string match with the corresponding records in its backend.
In case of success, the managed application is expected to generate a user session for the prescribed user Id as shared in the success response message.
The Cymmetri Identity platform responds back with a failure message in case of even one parameter mismatch from among - application ID, application Password, client IP address or the user session string (shared token).
In case of failure, the managed application is expected to cancel the login attempt and show the error message shared by the Cymmetri Identity platform.
For configuring the REST API based SSO mechanism, first select the application already added into your Cymmetri Identity platform deployment.
Then proceed to the SSO configuration using the “SignOn” link in the left-hand side menu bar.
Enable the Single SignOn by clicking the toggle button on the right-hand side of the page.
Now enter the application URL as below -
Application URL = <base url of the deployment>/apiSSO?applicationId=<applicationId>
Let us first copy the URL from the address bar -
The corresponding URL in my case is -
https://ssotester.cymmetri.io/application/6241c3b604c15417a91c7030/sign-on
We evaluate the following values from the URL -
Base URL of the deployment - https://ssotester.cymmetri.io
applicationId - 6241c3b604c15417a91c7030
Now we generate the Application URL as - https://ssotester.cymmetri.io/apiSSO?applicationId=6241c3b604c15417a91c7030
Let us enter this value in the Application URL text bar and click the “Save” button.
Let us proceed by selecting the radio button “API-based SSO”
Click on the dropdown “Advanced Settings (API)” to configure the API-based SSO and enter the information -
Source app token param name - Refers to the key of the query parameter used to share the randomly generated token from the Cymmetri backend.
Application Secret - Refers to the parameter app_pass that must be sent back by the managed application to validate the token.
Target App Redirect URL - Refers to the endpoint exposed by the managed application to receive the token as a query parameter.
Token Validity - number of seconds for which the generated token is valid. The managed application must send back the token for validation within these many seconds.
Target app token param name - This is the field that the managed application must use to send back the token for validation.
External Application ID - Refers to the parameter app_id that must be sent back by the managed application to validate the token.
Assign the application to a user.
On clicking the application tile, the user is redirected to the URL below as per the configuration above.
http://localhost:4124/getToken?auth_token=<random token>
Once the token is received by the application, the application makes a POST call as indicated by the CURL request below -
curl --location --request POST 'https://ssotester.cymmetri.io/api-sso/api/sso/validateToken' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'app_id=demoapps' \ --data-urlencode 'app_pass=Pras@4i1m$' \ --data-urlencode 'auth_token=<random token>' \ --data-urlencode 'user_ip=<client IP address>'
JSON response
{
“status”:”Success”,
“allow_user”:”true”,
“user_id”:”abhishek.kulkarni”
}
JSON Response
{
“status”:”User not verified”,
“allow_user”:”false”,
“user_id”:”abhishek.kulkarni”
}
In case of this error, “User not verified” message must be shown by the managed application. The user must not be allowed to login.
JSON Response
{
“status”:”Application not verified”,
“allow_user”:”false”,
“user_id”:”abhishek.kulkarni”
}
In case of this error, “Application not verified” message must be shown by the managed application. The user must not be allowed to login. The application configuration on the Cymmetri Identity platform and the managed application must be validation and cross-verified.
