KNF:Single Sign On query/en: verschil tussen versies

Uit Kennisnet Developers Documentatie
Naar navigatie springen Naar zoeken springen
 
(14 tussenliggende versies door 2 gebruikers niet weergegeven)
Regel 1: Regel 1:
 
{{PageTitleCustom|title=Single Sign On query|name=Kennisnet Federation|image=true|imageurl=KNF:Hoofdpagina/en}}
  
{{PageTitleCustom|title=Single Sign On query|name=Kennisnet Federation|image=true|imageurl=KNF:Hoofdpagina/en}}
 
==Introduction==
  
==Introduction==
−
The Single Sign ON query can be used on websites that allows both anonymous and authenticated users. The latter will have access to extended functionality or content.
 +
The Single Sign On query can be used on websites that allows both anonymous and authenticated users. The latter will have access to extended functionality or content.
   
 
To authenticate, the user needs to press the “Log in” button on the website, which starts the authentication process. However if the user already has a valid Single Sign On session with Entree, pressing the “Log in” button immediately logs on the user, without any further interaction (eg. entering a username and password). The requirement to press “Log in” is therefore unnecessary and not user friendly.
 
To authenticate, the user needs to press the “Log in” button on the website, which starts the authentication process. However if the user already has a valid Single Sign On session with Entree, pressing the “Log in” button immediately logs on the user, without any further interaction (eg. entering a username and password). The requirement to press “Log in” is therefore unnecessary and not user friendly.
Regel 7: Regel 7:
 
To prevent this scenario the website should have a detection mechanism in place which automatically recognizes users with a valid SSO session. This can be achieved with the Single Sign On query. This method is preferred over the 'SAML passive authentication' When using the SSO query, SAML passive authentication is not needed.
  
To prevent this scenario the website should have a detection mechanism in place which automatically recognizes users with a valid SSO session. This can be achieved with the Single Sign On query. This method is preferred over the 'SAML passive authentication' When using the SSO query, SAML passive authentication is not needed.
   
  +
−
==Implementation==
  
  +
'''Note:'''<br/>
⚫
The SSO query for Entree is based on the SSO query profile in OpenAselect. It is a simple query/response protocol. Both the query and its response are sent using HTTP redirects. The query is sent to a predefined URL, the response is sent to the URL that was specified in the query (if this URL is whitelisted - see below).
  
  +
To prevent abuse of this functionality, the domain should be included in the whitelist of Entree Federatie. Please contact [https://support.kennisnet.org/ Kennisnet] if you want to use SSO query.
  +
  ⚫
The SSO query is a simple query/response implementation. Both the query and its response are sent using HTTP redirects. The query is sent to a predefined URL, the response is sent to the whitelisted URL that was specified in the query.
   
 
The process has three possible outcomes:
  
The process has three possible outcomes:
  +
;false
−
#The user has no SSO session, and as far as we can tell, he is not logged in anywhere
  
−
#The user has a valid SSO session with Entree. The user can probably be authenticated without any interaction
 +
:The user does not have an SSO session and is not logged in anywhere by the Entree Federation. It is therefore unknown whether or not the user can log in via Entree Federation.
  +
;true
−
#The user has no SSO session with Entree, but an SSO notification is detected. This means, he is already authenticated in another remote identity provider (such as an LMS). The user can probably be authenticated without any interaction
  
  +
:The user has a valid SSO session with Entree. The user can be authenticated without any interaction
  +
;remote
  +
:The user does not have an SSO session, but an SSO notification cookie has been found. The user is already logged in to their own Identity Provider and will most likely be able to log in without user interaction.
   
−
===Example PHP implementation===
  
   
−
====SSO query====
 +
==Implementation==
  +
The query consists of an HTTP GET request with two parameters:
⚫
<syntaxhighlight lang="php">
  
  +
* response_url: this parameter must be URL encoded / UTF-8 in the URL
−
<?php
  
  +
* format: this optional parameter can be used to receive the answer in json format
−
$query_url = 'https://ssoquery.aselect-s.entree.kennisnet.nl/openaselect/sso/ssoquery';
  
  +
<br>
−
$response_url = 'https://domeinnaam/ssoresult.php';
  
  +
The following urls can be used:
   
  +
SSO Query endpoint:
−
$url = $query_url . '?response_url=' . urlencode($response_url);
  
  ⚫
<syntaxhighlight lang="HTML">
−  
  +
Production: https://ssoquery.entree.kennisnet.nl/sso/ssoquery?response_url=<URL>&format=json
−
header('Location: ' . $url, 302);
  
  +
Staging: https://ssoquery.entree-s.kennisnet.nl/sso/ssoquery?response_url=<URL>&format=json
−
?>
  
 
</syntaxhighlight>
  
</syntaxhighlight>
   
−
====SSO query result====
 +
===Example===
  +
;The Service Provider sends the request:
−
<syntaxhighlight lang="php">
  
  +
:https://ssoquery.entree.kennisnet.nl/sso/ssoquery?response_url=https%3A%2F%2Ftestapplicatie.kennisnet.nl
−
<?php
  
−
$result = array_key_exists('result', $_GET) ? $_GET['result'] : false;
  
−  
−
$resultValue = ($result === false ? '*none*' : $result);
  
−  
−
?>
  
−
<html>
  
−
<head>
  
−
<title>SSO query result</title>
  
−
</head>
  
−
<body>
  
−
<p>SSO query result is <?php print $resultValue; ?>.</p>
  
−
</body>
  
−
</html>
  
−
</syntaxhighlight>
  
   
  +
;Entree Federation redirects to the specified response URL:
  +
:https://testapplicatie.kennisnet.nl?result=true
   
−
==External links==
  
−
[https://docs.google.com/document/d/15Ng2VfA-rJf1GXTxO45niwwgNAA0LszLsTg-cPsvoBQ/edit?pli=1# Technical documentation]
  
   
 
[[Categorie:Entree Federatie]]
  
[[Categorie:Entree Federatie]]

Huidige versie van 19 sep 2023 om 12:16

KNF-symbol.png Kennisnet Federation: Single Sign On query

Nl.gif Nederlands En.gif English

Introduction

The Single Sign On query can be used on websites that allows both anonymous and authenticated users. The latter will have access to extended functionality or content.

To authenticate, the user needs to press the “Log in” button on the website, which starts the authentication process. However if the user already has a valid Single Sign On session with Entree, pressing the “Log in” button immediately logs on the user, without any further interaction (eg. entering a username and password). The requirement to press “Log in” is therefore unnecessary and not user friendly.

To prevent this scenario the website should have a detection mechanism in place which automatically recognizes users with a valid SSO session. This can be achieved with the Single Sign On query. This method is preferred over the 'SAML passive authentication' When using the SSO query, SAML passive authentication is not needed.


Note:
To prevent abuse of this functionality, the domain should be included in the whitelist of Entree Federatie. Please contact Kennisnet if you want to use SSO query.

The SSO query is a simple query/response implementation. Both the query and its response are sent using HTTP redirects. The query is sent to a predefined URL, the response is sent to the whitelisted URL that was specified in the query.

The process has three possible outcomes:

false
The user does not have an SSO session and is not logged in anywhere by the Entree Federation. It is therefore unknown whether or not the user can log in via Entree Federation.
true
The user has a valid SSO session with Entree. The user can be authenticated without any interaction
remote
The user does not have an SSO session, but an SSO notification cookie has been found. The user is already logged in to their own Identity Provider and will most likely be able to log in without user interaction.


Implementation

The query consists of an HTTP GET request with two parameters:

  • response_url: this parameter must be URL encoded / UTF-8 in the URL
  • format: this optional parameter can be used to receive the answer in json format


The following urls can be used:

SSO Query endpoint: 

Production: https://ssoquery.entree.kennisnet.nl/sso/ssoquery?response_url=<URL>&format=json
Staging: https://ssoquery.entree-s.kennisnet.nl/sso/ssoquery?response_url=<URL>&format=json

Example

The Service Provider sends the request
https://ssoquery.entree.kennisnet.nl/sso/ssoquery?response_url=https%3A%2F%2Ftestapplicatie.kennisnet.nl
Entree Federation redirects to the specified response URL
https://testapplicatie.kennisnet.nl?result=true
Overgenomen van "https://developers.wiki.kennisnet.nl/index.php?title=KNF:Single_Sign_On_query/en&oldid=12788"