KNF:SSOnotification/en: verschil tussen versies

Uit Kennisnet Developers Documentatie
Ga naar: navigatie, zoeken
(Example with SSOnotification:)
 
(7 tussenliggende versies door dezelfde gebruiker niet weergegeven)
Regel 3: Regel 3:
 
If a school has its own connection with the Entree Federation (for example an ELE (electronic learning environment) or an ADFS) there is the possibility to skip the WAYF ('''W'''here '''A'''re '''Y'''ou '''F'''rom) screen of Entree. This is done via the use of a cookie, which is set '''after''' the user has logged in on his own environment (for example an intranet page or the homepage of the ELE).
 
If a school has its own connection with the Entree Federation (for example an ELE (electronic learning environment) or an ADFS) there is the possibility to skip the WAYF ('''W'''here '''A'''re '''Y'''ou '''F'''rom) screen of Entree. This is done via the use of a cookie, which is set '''after''' the user has logged in on his own environment (for example an intranet page or the homepage of the ELE).
   
The cookie only contains information about the school on the basis of which the correct school is selected in the Entree inlog screen.
+
The cookie only contains information about the Identity Provider on the basis of which the correct Identity Provider is selected on the Entree WAYF screen.
   
To show the advantage of SSOnotification follow the two scenarios beneath.
+
To show the advantage of SSO notification follow the two scenarios beneath.
   
 
== Example without SSOnotification: ==
 
== Example without SSOnotification: ==
 
To simulate this scenario follow these steps:
 
To simulate this scenario follow these steps:
 
#'''The student/teacher logs in on the ELE/Active directory'''
 
#'''The student/teacher logs in on the ELE/Active directory'''
#*Go to: [https://referentie.entree.kennisnet.nl/ReferentieELO/app Reference ELE]
+
#*Go to: [https://referentie.entree.kennisnet.nl/referentie Reference ELE]
 
#'''The student/teacher clicks on a link to learning material'''
 
#'''The student/teacher clicks on a link to learning material'''
 
#*Click on 'Naar dienst' ('To service')
 
#*Click on 'Naar dienst' ('To service')
 
#'''You're going to the WAYF (Where Are You From) screen. There's no information available about the school the user is coming from.'''
 
#'''You're going to the WAYF (Where Are You From) screen. There's no information available about the school the user is coming from.'''
  +
#*Search and select 'Referentie Omgeving' ('Reference application')
#*Select 'Inloggen via je school' ('Login by school')
 
  +
#*Click on 'Verder' ('next')
#*Then select 'Referentie Klant Organisatie' ('Reference customer organisation')
 
  +
#'''The user data (attributes) are requested from the Identity Provider by Entree Federation'''
#*Click on 'verder' ('next')
 
#'''This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel'''
+
#*This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel
  +
#*Click on 'Direct verder naar dienstaanbieder' ('Directly to Service Provider')
#*Enter the dummy data
 
#*Click on 'Naar dienst' ('To service')
 
 
#'''The user is now logged in and subsequently the user attributes that were used during the login process are shown.'''
 
#'''The user is now logged in and subsequently the user attributes that were used during the login process are shown.'''
   
Regel 25: Regel 24:
 
To simulate this scenario follow these steps:
 
To simulate this scenario follow these steps:
 
#'''The student/teacher logs in on the ELE/Active directory'''
 
#'''The student/teacher logs in on the ELE/Active directory'''
#*Go to: [https://referentie.entree.kennisnet.nl/ReferentieELO/app Reference ELE]
+
#*Go to: [https://referentie.entree.kennisnet.nl/referentie Reference ELE]
#*Click on 'SSO Notification'
+
#*Click on 'SSO Notificatie instellen' ('Set SSO notification')
 
#'''The student/teacher clicks on a link to learning material'''
 
#'''The student/teacher clicks on a link to learning material'''
#*Click on 'Naar dienst' ('To service')<br/><span style="color:#ff0000">In this scenario the WAYF (Where Are You From) screen will '''not''' be shown. The system reads the cookie that is used for SSOnotification and automatically selects the correct school.</span>
+
#*Click on 'Naar dienst' ('To service')<br/><span style="color:#ff0000">In this scenario the WAYF screen will '''not''' be shown. The system reads the cookie that is used for SSO notification and automatically selects the correct school.</span>
  +
#'''The user data (attributes) are requested from the Identity Provider by Entree Federation'''
#'''This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel'''
 
  +
#*This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel
#*Enter the dummy data
 
#*Click on 'Naar dienst' ('To service')
+
#*Click on 'Direct verder naar dienstaanbieder' ('Directly to Service Provider')
 
#'''The user is now logged in and subsequently the user attributes that were used during the login process are shown.'''
 
#'''The user is now logged in and subsequently the user attributes that were used during the login process are shown.'''
   

Huidige versie van 14 sep 2020 om 16:35

KNF-symbol.png Entree Federation: SSOnotification

Nl.gif Nederlands En.gif English

If a school has its own connection with the Entree Federation (for example an ELE (electronic learning environment) or an ADFS) there is the possibility to skip the WAYF (Where Are You From) screen of Entree. This is done via the use of a cookie, which is set after the user has logged in on his own environment (for example an intranet page or the homepage of the ELE).

The cookie only contains information about the Identity Provider on the basis of which the correct Identity Provider is selected on the Entree WAYF screen.

To show the advantage of SSO notification follow the two scenarios beneath.

Example without SSOnotification:

To simulate this scenario follow these steps:

  1. The student/teacher logs in on the ELE/Active directory
  2. The student/teacher clicks on a link to learning material
    • Click on 'Naar dienst' ('To service')
  3. You're going to the WAYF (Where Are You From) screen. There's no information available about the school the user is coming from.
    • Search and select 'Referentie Omgeving' ('Reference application')
    • Click on 'Verder' ('next')
  4. The user data (attributes) are requested from the Identity Provider by Entree Federation
    • This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel
    • Click on 'Direct verder naar dienstaanbieder' ('Directly to Service Provider')
  5. The user is now logged in and subsequently the user attributes that were used during the login process are shown.

Example with SSOnotification:

To simulate this scenario follow these steps:

  1. The student/teacher logs in on the ELE/Active directory
    • Go to: Reference ELE
    • Click on 'SSO Notificatie instellen' ('Set SSO notification')
  2. The student/teacher clicks on a link to learning material
    • Click on 'Naar dienst' ('To service')
      In this scenario the WAYF screen will not be shown. The system reads the cookie that is used for SSO notification and automatically selects the correct school.
  3. The user data (attributes) are requested from the Identity Provider by Entree Federation
    • This step is unique for our Reference ELE, because of the possibility to enter dummy data. Normally the user attributes are sent through the back channel
    • Click on 'Direct verder naar dienstaanbieder' ('Directly to Service Provider')
  4. The user is now logged in and subsequently the user attributes that were used during the login process are shown.

Implementation

When an Identity Provider places an SSO notification cookie via an AJAX call or an iframe by Entree Federation, this is considered to be a third party cookie. Third party cookies are placed by domains (in this case Entree Federation) other than the domain of the website you are visiting (the Identity Provider). Some organizations use third party cookies to track users when they visit different websites. Since this type of third party cookies (also called tracking cookies) can infringe the privacy of users, their use is increasingly discouraged by browsers and often blocked.

This may prevent the SSO notification cookie from being placed. In such a case, the user can still log in via Entree Federation, but will have to select his or her school on the WAYF screen of Entree Federation. Since browsers have indicated to block third party cookies completely in the long term, placing an SSO notification is best done by means of a redirect.