Single Sign-On Guide for Blackbaud NetCommunity and The Patron Edge Online

Transcription

1 Single Sign-On Guide for Blackbaud NetCommunity and The Patron Edge Online

2 Blackbaud, Inc. This publication, or any part thereof, may not be reproduced or transmitted in any form or by any means, electronic, or mechanical, including photocopying, recording, storage in an information retrieval system, or otherwise, without the prior written permission of Blackbaud, Inc. The information in this manual has been carefully checked and is believed to be accurate. Blackbaud, Inc., assumes no responsibility for any inaccuracies, errors, or omissions in this manual. In no event will Blackbaud, Inc., be liable for direct, indirect, special, incidental, or consequential damages resulting from any defect or omission in this manual, even if advised of the possibility of damages. In the interest of continuing product development, Blackbaud, Inc., reserves the right to make improvements in this manual and the products it describes at any time, without notice or obligation. All Blackbaud product names appearing herein are trademarks or registered trademarks of Blackbaud, Inc. All other products and company names mentioned herein are trademarks of their respective holder. SingleSignOnGuide-2012

3 Contents INSTALLATION AND CONFIGURATION Single Sign-On Requirements Single Sign-On Configuration Checklist IIS Configuration Settings Web.config File Settings Security Considerations Blackbaud NetCommunity Settings Step 1: Blackbaud Core Components Web Services Settings Step 2: The Patron Edge Online Web Services Settings Step 3: Synchronize The Patron Edge Online Configuration Step 4: Single Sign-On Authentication Step 5: Patron Edge Online Authentication Patron Edge Online Settings Configure The Patron Edge Online To Use Blackbaud NetCommunity Single Sign-On Pages Blackbaud NetCommunity Tabs Create Customized Warning Messages Patron Edge Online Synchronization Settings Blackbaud NetCommunity Links In The Patron Edge Online Patron Edge Online Links In Blackbaud NetCommunity Disable Single Sign-On Authentication SINGLE SIGN-ON USER AND ADMINISTRATOR WORKFLOW Single Sign-On Overview Raiser s Edge NetCommunity Page Link Records Process Specify Role Assignments and Constituent Codes Use PEO Auto-Link to Link Existing Records Manually Link Records Link and Process New Records INDEX

4

5 chapter 1 Installation and Configuration Single Sign-On Requirements Single Sign-On Configuration Checklist IIS Configuration Settings Web.config File Settings Security Considerations Blackbaud NetCommunity Settings Patron Edge Online Settings Patron Edge Online Synchronization Settings Blackbaud NetCommunity Links In The Patron Edge Online Patron Edge Online Links In Blackbaud NetCommunity Disable Single Sign-On Authentication Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline creates a single sign-on experience for users of BlackbaudNetCommunity and ThePatronEdgeOnline. By using a single sign-on, users gain access to either program while logging in only once. Navigation links can be configured for both programs to help users move between pages based on workflow. This chapter provides installation and configuration information for Single Sign-on with Blackbaud NetCommunity and ThePatronEdgeOnline as well as information about the integration between ThePatronEdgeOnline and BlackbaudNetCommunity. Many of the installation and configuration steps in this chapter will be implemented by a consultant or in collaboration with a consultant. For an overview of the single sign-on experience as well as additional information about the integration between BlackbaudNetCommunity, ThePatronEdge, ThePatronEdgeOnline, and TheRaiser sedge, see Single Sign-On User and Administrator Workflow on page 21. Warning: Before using the Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline feature, you must ensure integration between The Patron Edge and The Raiser s Edge has run.

6 2 CHAPTER 1 Warning: Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online relies on integration between ThePatronEdge and TheRaiser'sEdge. Therefore, this feature is only available in an environment where TheRaiser'sEdge is not hosted. Single Sign-On Requirements Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline requires BlackbaudNetCommunity 6.45 patch 13 or higher, ThePatronEdgeOnline or higher, and ThePatronEdge3.406 or higher. You must use TheRaiser sedge 7.91 to integrate with Blackbaud NetCommunity 6.45 patch 13. Note: If Blackbaud hosts your PatronEdgeOnline applications and websites, we will communicate the scheduled date for your upgrade. After the upgrade is complete, you must follow additional instructions to complete the update process. For more information, see ThePatronEdgeOnline Update Guide. To successfully enable this single sign-on feature, you must edit the web.config file for the PEOEndpoint Masterservice, and configure several areas within the administration sites of BlackbaudNetCommunity and ThePatronEdgeOnline. Once these settings are configured properly, information can be communicated between both programs. Single Sign-On Configuration Checklist This checklist includes the necessary installation and configuration tasks, as well as additional information to implement Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline. Many of the installation and configuration steps in this chapter will be implemented by a consultant or in collaboration with a consultant. If we are hosting your Patron Edge Online applications or websites, a consultant will implement or work in collaboration with you to implement a specific configuration setting in Internet Information Services (IIS) 6.0. Again, this setting is only necessary in a hosted environment. For more information, refer to your consultant. After you install or update to ThePatronEdgeOnline or higher, you must manually specify the path of the TopTixEsro2.ini file in the web.config file for the PEOEndpoint Masterservice. This must be done on the PatronEdgeOnline web server. For more information, see Web.config File Settings on page 3. We recommend your web server is secured with Secure Socket Layer (SSL) or equivalent technology to prevent unauthorized access to transmitted data. For more information about security recommendations, see Security Considerations on page 4. To ensure a successful single-sign on experience, in the administration site for BlackbaudNetCommunity, you must work with web services settings for Blackbaud core components as well as web services, synchronization, and authentication settings for ThePatronEdgeOnline. For more information, see Blackbaud NetCommunity Settings on page 4. To ensure a successful single sign-on experience, in the administration site for ThePatronEdgeOnline, you can configure Blackbaud NetCommunity tab and page criteria. You can also customize warning messages to appear when a user accesses a Blackbaud NetCommunity web page from a PatronEdgeOnline web page. For more information, see Patron Edge Online Settings on page10.

7 INSTALLATION AND CONFIGURATION 3 When you use the Synchronize PEO configuration option, configuration settings are automatically synchronized with ThePatronEdgeOnline. If the information does not synchronize successfully, you must manually enter configuration information in the administration site for ThePatronEdgeOnline. For more information about these manual settings, see Patron Edge Online Synchronization Settings on page16. You can configure Blackbaud NetCommunity navigation links to appear in The Patron Edge Online. For more information, see Blackbaud NetCommunity Links In The Patron Edge Online on page 18. You can configure PatronEdgeOnline navigation links to appear in Blackbaud NetCommunity. For more information, see Patron Edge Online Links In Blackbaud NetCommunity on page 18. IIS Configuration Settings If we are hosting your Patron Edge Online applications or websites, a consultant will implement or work in collaboration with you to implement a specific configuration setting in Internet Information Services (IIS) 6.0. Again, this setting is only necessary in a hosted environment. For more information, refer to your consultant. After this setting is configured, continue to the next step Web.config File Settings on page 3. Web.config File Settings After you install or update to ThePatronEdgeOnline or higher, you must manually specify the path of the TopTixEsro2.ini file in the web.config file for the PEOEndpoint Masterservice. This must be done on the PatronEdgeOnline web server. The web.config file is located in the PEOEndpoint folder in the directory where you installed The Patron Edge Online. The location of the TopTixEsro2.ini file may differ depending on your setup. An example path may resemble the following: <add key= Esro2INIPath value = E:\Program Files\Blackbaud\The Patron Edge Online\TopTixESRO2.ini /> For more information about web.config files, see the Infinity Installation and Upgrade Guide.

8 4 CHAPTER 1 Security Considerations We recommend your web server is secured with Secure Socket Layer (SSL) or equivalent technology to prevent unauthorized access to transmitted data. Note: Blackbaud is not responsible for the installation, configuration, and testing of any web security measures. Blackbaud assumes no responsibility for the security of your web server and any adverse consequences resulting from security issues. Blackbaud software does not establish or modify security on the web server. Please refer to for specific security measures and NTFS permissions needed by Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 as well as Internet Information Services (IIS). Blackbaud NetCommunity Settings To ensure a successful single-sign on experience, in the administration site for BlackbaudNetCommunity, you must work with web services settings for Blackbaud core components as well as web services, synchronization, and authentication settings for The Patron Edge Online. Use the following steps as a checklist to ensure accurate configuration for Blackbaud NetCommunity settings. We recommend you follow the configuration steps in order, taking note that some options are designed to allow automatic configuration while other steps must be done manually. For information about settings in ThePatronEdgeOnline, see Patron Edge Online Settings on page 10. Step 1: Blackbaud Core Components Web Services Settings Enter information about the Blackbaud core components that you must install on the web server. Establish web services settings for Blackbaud core components 1. From the administration site for BlackbaudNetCommunity, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab.

9 INSTALLATION AND CONFIGURATION 5 2. Under Blackbaud core components, in the URL field, enter the location of the Blackbaud core components. The core components include all files and configuration settings required to integrate the website and its database, as well as the services required by your website. 3. In the Database ID field, enter the ID for your website s database. 4. Under Credentials for bbappfx web service, select Specific user. In the User and Password fields, enter valid Windows login credentials to connect to the bbappfx web service. To successfully connect to the bbappfx web service, valid Windows users must be added as application users to the Infinity platform. To add application users, use the Blackbaud AppFx Configuration Manager tool. For more information about this tool, refer to the Infinity Platform Installation and Upgrade Guide at Warning: In Step 3, the specific user login credentials you enter here are used during the Synchronization PEO configuration process. If you enter default credentials, the Synchronize PEO configuration process cannot succeed. For more information about Step 3, see Step 3: Synchronize The Patron Edge Online Configuration on page To save the settings, click Save. Tip: Enter the URL and login credentials in any web browser to make sure the credentials are valid. Step 2: The Patron Edge Online Web Services Settings ThePatronEdgeOnline web services settings include the web service URL and login credentials that allow Blackbaud NetCommunity to communicate with The Patron Edge Online. Establish web services settings for The Patron Edge Online 1. From the administration site for BlackbaudNetCommunity, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab.

10 6 CHAPTER 1 2. Under Patron Edge Online, in the URL field, enter the location of the web service. For example, you can enter where servername is the name of your PatronEdgeOnline web service URL. Tip: To locate the web service URL, review the PEOEndpoint virtual directory in Internet Information Services (IIS). 3. Select Default credentials or Specific user to specify login credentials for the PEOEndpoint Master Service. When you select Default credentials, credentials from the BlackbaudNetCommunity application pool are used to connect to the PEOEndpoint Master Service. When you select Specific user, the User and Password fields appear. Enter valid Windows login credentials to connect to the PEOEndpoint Master Service. You can also enter domain credentials that can be used across all the sites associated with your organization. Tip: If you use basic authentication, select Specific user and enter credentials for a Windows user account. If you use Windows authentication, you can use default credentials from the application pool or use a Windows user account. 4. To save the settings, click Save. Tip: Enter the URL and login credentials in any web browser to make sure the credentials are valid. Step 3: Synchronize The Patron Edge Online Configuration When you use the Synchronize PEO configuration option, the following configuration settings are automatically synchronized with ThePatronEdgeOnline: ASMX URL BBNC Base URL Database Domain Password SSO Shared Key User Name When the synchronization is successful, a green checkmark appears next to the Synchronize PEO configuration button. You do not need to manually enter values for these fields in ThePatronEdgeOnline unless an error occurs during synchronization. For information about these configuration settings and how to manually enter values for them, see Patron Edge Online Synchronization Settings on page 16. The synchronization process uses the specific user credentials you established for your Blackbaud core components web services settings to communicate with the PatronEdgeOnline web service. For more information about these settings, see Step 1: Blackbaud Core Components Web Services Settings on page 4.

11 INSTALLATION AND CONFIGURATION 7 Synchronize The Patron Edge Online configuration 1. From the administration site for BlackbaudNetCommunity, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Patron Edge Online tab. 2. Under Configuration, click Synchronize PEO configuration. The process synchronizes all configuration settings with ThePatronEdgeOnline. When the synchronization is successful, a green checkmark appears next to the Synchronize PEO configuration button. The synchronization process uses the specific user credentials you established for your Blackbaud core components web services settings to communicate with the PatronEdgeOnline web service. For more information about these settings, see Step 1: Blackbaud Core Components Web Services Settings on page 4. The synchronization process also automatically enables the Single sign-on authentication checkbox (discussed in Step 4) and creates a new single sign-on entry for ThePatronEdgeOnline. This affects the site to which you are currently logged in. You can repeat this process for all sites that uses Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online. If you do not use the Synchronize PEO configuration option, you must manually check the Single sign-on authentication checkbox (discussed in Step 4) and create a new single sign-on entry. For more information, see Step 4: Single Sign-On Authentication on page 7. Warning: In Step 1, you entered specific user login credentials to use during the Synchronization PEO configuration process. If you selected Default credentials in Step 1, the Synchronize PEO configuration process cannot succeed. For more information about Step 1, see Step 1: Blackbaud Core Components Web Services Settings on page To save the settings, click Save. Step 4: Single Sign-On Authentication To successfully use Single Sign-on with Blackbaud NetCommunity and ThePatronEdgeOnline, the Single sign-on authentication checkbox must be checked for each site that uses Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online. A new single sign-on entry must also be created. When you use the Synchronize PEO configuration option in Step 3, the synchronization process automatically checks the Single sign-on authentication checkbox for the site you are currently logged in, and creates a new single sign-on entry. When you use this option, the synchronization process is automated and you can proceed to Step 5. For more information about Step 5, see Step 5: Patron Edge Online Authentication on page 9.

12 8 CHAPTER 1 If you do not use the Synchronize PEO configuration option in Step 3, you must manually check the Single sign-on authentication checkbox and enter a new single sign-on entry for each site that uses Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline. Use the Enable single sign-on authentication on page 8 procedure below to manually enter a new single sign-on entry. Warning: We strongly recommend that full Supervisor rights for Sites & settings are only assigned to a select group of users. General users should not access this section of the program because changes can affect multiple web pages and sites. Only users knowledgeable in all areas of website creation and publishing should perform tasks in Sites & settings. Enable single sign-on authentication With single sign-on, you can click a unique link from a Patron Edge Online page to access BlackbaudNetCommunity secure pages without entering user name and password information. When you enable single sign-on, users are authenticated by a shared key and time algorithm in a querystring, such as: &u=supervisor&t= &m=282fe2ecf98f5ffedaab12a38f3a3d From the administration site for Blackbaud NetCommunity, click Administration, Sites & settings. From the Sites & settings page that appears, select a website from the treeview on the left and click the Settings tab. 2. Under Single sign-on authentication, select Enable single sign-on authentication. 3. In the grid, enter the information to use with the single sign-on system. a. Under Description, enter a unique name to identify the single sign-on instance. b. Under Shared Key, enter a string value key used by the single sign-on system to access your website. We recommend a combination of letters and numbers. The shared key is stored as a site setting within the administration site for ThePatronEdgeOnline. For more information about this site setting, see Patron Edge Online Synchronization Settings on page 16. c. The querystring columns contain the three variable parameters that other single sign-on systems pass via the URL. Under UserName querystring, enter u. This is the plain text variable that identifies the user name in the querystring generated by the single sign-on system. Under Time querystring, enter t. This is the variable that indicates the timestamp in the querystring generated by the single sign-on system. The timestamp is in epochtime when the URL was created. Epochtime is the number of seconds since January 1, Under MD5 Hash querystring, enter m. This is the variable that indicates the MD5 hash value in the query string generated by the single sign-on system.

13 INSTALLATION AND CONFIGURATION 9 d. In the Expiration (seconds) column, enter for how long after the timestamp generated in the querystring the user has transparent access to the web page. By default, the single sign-on authentication expires after 300 seconds (5 minutes). e. Do not select the checkbox in the Include IP column. The single sign-on system does not use the client IP address as additional security. f. To require secure sockets layer for additional security, select the checkbox in the Require SSL column. When you select this, pages require URLs that begin with https. g. If you maintain multiple third-party web pages on your site, click Add New to add additional single sign-on entries. For security purposes, we recommend a separate entry for each third party integration. 4. To edit an existing single sign-on entry, click Edit and update the information as necessary. 5. To delete an existing single sign-on entry, click Delete. At the message to confirm the deletion of the row, click Yes. 6. To save the settings, click Save. Step 5: Patron Edge Online Authentication The last step in your configuration checklist is to check the Patron Edge Online authentication checkbox and confirm the value in The Patron Edge Online URL field is correct for each site that uses Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline. Enable Patron Edge Online authentication 1. From the administration site for BlackbaudNetCommunity, click Administration, Sites & settings. From the Sites & settings page, select a website from the treeview on the left and click the Settings tab. 2. Under Patron Edge Online authentication, select Enable Patron Edge Online authentication. 3. In The Patron Edge Online URL field, confirm the URL is correct. This is the base URL to your Patron Edge Online website. The current site uses the specified URL to create links to ThePatronEdgeOnline. If the URL is not correct, ensure the Synchronize URL automatically from PEO checkbox is selected and use the Synchronize PEO configuration option in Step 3. For more information, see Step 3: Synchronize The Patron Edge Online Configuration on page 6.

14 10 CHAPTER 1 To manually enter a URL, deselect Synchronize URL automatically from PEO and enter a URL. Warning: We strongly recommend that ThePatronEdgeOnline is properly configured before you enable this option. Ensure that you use the Synchronize PEO configuration option or manually enter values for your configuration settings in ThePatronEdgeOnline before you check the Enable Patron Edge Online authentication checkbox. 4. To save the settings, click Save. You must repeat this process for each site that uses Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online. Patron Edge Online Settings To ensure a successful single sign-on experience, in the administration site for ThePatronEdgeOnline, you can configure Blackbaud NetCommunity tab and page criteria. You can also customize warning messages to appear when a user accesses a Blackbaud NetCommunity web page from a Patron Edge Online web page. Configure The Patron Edge Online To Use Blackbaud NetCommunity Single Sign-On Pages To ensure that ThePatronEdgeOnline successfully communicates with Blackbaud NetCommunity during the login process, you must configure page settings in the administration site for The Patron Edge Online.

15 INSTALLATION AND CONFIGURATION 11 Configure The Patron Edge Online to use Blackbaud NetCommunity single sign-on pages 1. From ThePatronEdgeOnline administration site, click Content to display Site Design on the navigation bar. Under Site Design, click Screens. The Site Design - Screens page appears. 2. Select the interface you currently use for your public site. 3. Double-click crm_details.asp screen. The Edit Record screen appears. 4. In the Include Before field, enter BBNCUserHandler.asp and click Ok.

16 12 CHAPTER 1 5. Double-click default.asp. The Edit Record screen appears. 6. In the Include Before field, enter BBNCUserHandler.asp and click Ok. 7. Double-click user_data.asp screen. The Edit Record screen appears. 8. In the Include After field, enter BBNCUserHandler.asp and click Ok. Blackbaud NetCommunity Tabs In the administration site for ThePatronEdgeOnline, you can configure options within Content and Administration to display Blackbaud NetCommunity tabs in ThePatronEdgeOnline. The tabs you define display on a user s profile page in ThePatronEdgeOnline. Note: These tab settings are optional and are not required to successfully enable the Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online feature. Configure Blackbaud NetCommunity tabs in Site Design 1. From ThePatronEdgeOnline administration site, click Content to display Site Design on the navigation bar. Under Site Design, click Screens. The Site Design - Screens page appears. 2. In the Interface field, select the interface you currently use for your public site.

17 INSTALLATION AND CONFIGURATION Under the Screen (Page) column, select crm_details.asp and click Screen parts location tool in the tool bar. The Screen parts location tool screen appears. 4. Under Properties, in the Includes frame, enter BBNCTabs.asp in the Before field. You want to ensure BBNCTabs.asp is included before the crm_details_1.asp part. Configure Blackbaud NetCommunity tabs in System Setup 1. From ThePatronEdgeOnline administration site, click Administration to display System Setup on the navigation bar. Under System Setup, click PEO NetCommunity Tabs. The System Setup - PEO NetCommunity Tabs page appears.

18 14 CHAPTER 1 2. Click Add New. The New Record screen appears. 3. The program automatically generates a number in the ID field. You do not need to enter or change information in this field. 4. In the BBNC Page ID field, enter the Blackbaud NetCommunity page ID for each tab you want to display on the user s profile page. To obtain a page ID in Blackbaud NetCommunity, select the page in Pages & templates. On the Properties tab, the ID appears in the Page ID row. For more information about page properties, see the Website Design Guide for Blackbaud NetCommunity. 5. In the Display text field, enter display text for each tab. Display text explains the purpose of the tab. We recommend you add concise, user-friendly descriptions so that users understand the tab s purpose. Examples of tab descriptions are View public profile, View giving history, and Update my preferences. 6. In the Ordinal field, enter a number. The ordinal represents the order the tabs display. 7. Click Ok. Repeat this procedure for each tab you want to display on the user s profile page. Create Customized Warning Messages You can edit language setting codes to create customized text for two warning messages that display in The Patron Edge Online. The first language setting code is 9090 and represents a warning message that displays when a user accesses a Blackbaud NetCommunity web page from a PatronEdgeOnline web page, and content exists in the user s Patron Edge Online shopping cart. The second language setting code is 9091 and represents a warning message that displays when a user accesses a Blackbaud NetCommunity web page from a PatronEdgeOnline web page, and an error occurs. For example, an error may appear when the program cannot verify Blackbaud NetCommunity login credentials.

19 INSTALLATION AND CONFIGURATION 15 Create customized warning messages in for The Patron Edge Online 1. From ThePatronEdgeOnline administration site, click Content to display Site Design on the navigation bar. Under Site Design, click Language Settings. The Site Design - Language Settings page appears. 2. In the grid, double-click Code The Edit Record screen appears. 3. In the English (string) field, enter text for the warning message. The message lets the user know that content exists in the user s PatronEdgeOnline shopping cart and items are lost when the user leaves a PatronEdgeOnline web page and moves to a Blackbaud NetCommunity web page. 4. Click Ok. 5. In the grid, double-click Code The Edit Record screen appears. 6. In the English (string) field, enter text for a general warning message. The message should let the user know that, in general, an error has occurred. 7. Click Ok.

20 16 CHAPTER 1 Patron Edge Online Synchronization Settings If the Synchronize PEO configuration option in Step 3 does not successfully synchronize configuration settings with ThePatronEdgeOnline, a red indicator appears next to the Synchronize PEO configuration button. For more information about Step 3, see Step 3: Synchronize The Patron Edge Online Configuration on page 6. Ensure your firewall settings allow the Blackbaud NetCommunity server to communicate with ThePatronEdgeOnline web server. If your firewall settings are not causing a communication issue, you must manually configure site settings within the administration site of The Patron Edge Online. From ThePatronEdgeOnline administration site, click Administration to display System Setup on the navigation bar. Under System Setup, click PEO NetCommunity. The NetCommunity Single Sign-On Configuration page appears. You must manually configure the following settings. ASMX URL. Enter the Blackbaud AppFx web service URL that originates from the Infinity web service. In an Infinity-based program, use Endpoints to access this URL.

21 INSTALLATION AND CONFIGURATION 17 BBNC Base URL. Enter the URL for the Blackbaud NetCommunity website. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select a website from the treeview on the left that has single-sign on authentication and PatronEdgeOnline authentication enabled. Click the Settings tab. Under General, use the value you entered in the Site URL field. Database. Enter the database ID which identifies your website s database. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab. Under Blackbaud core components, use the value you entered in the Database ID field. Domain. Enter the specific user s domain name for the bbappfx web service. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab. Under Blackbaud core components, select Specific user. Use the domain name value you entered in the User field. When the user is local to the PatronEdgeOnline web server, you can either omit the Domain field or enter the computer name. Password. Enter the specific user s password for the bbappfx web service. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab. Under Blackbaud core components, select Specific user. Use the value you entered in the Password field. The saved password is encrypted. SSO Shared Key. Enter the single sign-on shared key value used by the single sign-on system to access your website. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select a website from the treeview on the left and click the Settings tab. Under Single sign-on authentication, use the value in the Shared key field. Depending on your organization s setup, you may have more than one single sign-on entry. Remember to reference the shared key associated with Single Sign-on with Blackbaud NetCommunity and ThePatronEdgeOnline. For each site that uses Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline, you must use this same shared key. User Name. Enter the specific user s user name for the bbappfx web service. You can find this value in the administration site for Blackbaud NetCommunity. From the administration site, click Administration, Sites & settings. From the Settings tab of the Sites & settings page, select the top-level item in the treeview on the left and click the Web services tab. Under Blackbaud core components, select Specific user. Use the value you entered in the User field. To save the options on the NetCommunity Single Sign-On Configuration screen, click Save. If your information saves correctly, a Save successful indicator appears at the top of the page.

22 18 CHAPTER 1 Blackbaud NetCommunity Links In The Patron Edge Online Review the following information to ensure Blackbaud NetCommunity navigation links appear in The Patron Edge Online. For information about creating and editing links in The Patron Edge Online, see the Site Design Basics Guide. To link to Blackbaud NetCommunity from The Patron Edge Online via the menu links in The Patron Edge Online, use the BBNCTranslate.asp page as a proxy. A sample link might look like The bbwrn parameter determines if a warning message appears when a user attempts to leave the site while items still remain in the user s shopping cart. Set this to 0 if you do not want the user to be warned. The bbpid parameter is the Blackbaud NetCommunity page ID you want to link to. Additional querystring values are ignored and passed to the destination page. You can use the Menu Items functionality in ThePatronEdgeOnline to add menu links to Blackbaud NetCommunity. For the menu item's target, use the BBNCTranslate page. Patron Edge Online Links In Blackbaud NetCommunity Review the following information to ensure PatronEdgeOnline navigation links appear in BlackbaudNetCommunity. For information about creating and editing links in Blackbaud NetCommunity, see the Program Basics Guide. Warning: When creating a URL, be sure to use the domain name for the PatronEdgeOnline Web Server instead of its IP address. Using an IP address to create PatronEdgeOnline links in Blackbaud NetCommunity is currently not supported. To create a link to ThePatronEdgeOnline in BlackbaudNetCommunity, we suggest you use the following URL syntax for the link: where YYY is the name of a Patron Edge Online page (for example, all_events.asp). To create a URL to log a user in or out, the following URL syntax is used: This link logs a user out of both systems if they are logged in, or redirects them to the login page if they are not logged in. Querystring values other than bburl are ignored and passed to the destination page. Disable Single Sign-On Authentication You can disable Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline for any site associated with your organization. When you disable this feature, the single sign-on experience for users of Blackbaud NetCommunity and The Patron Edge Online is removed.

23 INSTALLATION AND CONFIGURATION 19 From the administration site for BlackbaudNetCommunity, click Administration, Sites & settings. From the Sites & settings page that appears, select a website from the treeview on the left and click the Settings tab. Clear the Single Sign-on authentication and Patron Edge Online authentication checkboxes and click Save. If you enable Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline at a later time, we recommend you use the PEO Auto-link process in BlackbaudNetCommunity. For more information about this process, see Single Sign-On User and Administrator Workflow on page 21. Note: When you disable this feature, ThePatronEdgeOnline continues to try to communicate with Blackbaud NetCommunity unless you remove the page setting options you specified in the PatronEdgeOnline administration site. For more information, see Configure The Patron Edge Online To Use Blackbaud NetCommunity Single Sign-On Pages on page 10.

24 20 CHAPTER 1

25 chapter 2 Single Sign-On User and Administrator Workflow Single Sign-On Overview Raiser s Edge NetCommunity Page Link Records Process Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline creates a single sign-on experience for users of BlackbaudNetCommunity and ThePatronEdgeOnline. By using a single sign-on, users gain access to either program while logging in only once. Navigation links can be configured for both programs to help users move between pages based on workflow. This chapter provides an overview of the single sign-on experience as well as the integration between BlackbaudNetCommunity, ThePatronEdge, ThePatronEdgeOnline, and TheRaiser sedge. For more information about installation, see Installation and Configuration on page 1. Note: Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline requires Blackbaud NetCommunity 6.45 patch 13 or higher, ThePatronEdgeOnline or higher, and ThePatronEdge or higher. You must use TheRaiser sedge 7.91 to integrate with Blackbaud NetCommunity 6.45 patch 13. Warning: Single Sign-On with Blackbaud NetCommunity and The Patron Edge Online relies on integration between ThePatronEdge and TheRaiser'sEdge. Therefore, this feature is only available in an environment where TheRaiser'sEdge is not hosted. Single Sign-On Overview The following list provides an overview of the functionality and behavior that users and administrators can expect during the single sign-on experience. When a user logs into either Blackbaud NetCommunity or ThePatronEdgeOnline, a PatronEdgeOnline login screen displays. After logging in, the user has access to both the ticketing and BlackbaudNetCommunity portals of the sites and is able to navigate between the two based on the single sign-on functionality. When a user creates a new PatronEdgeOnline account, a BlackbaudNetCommunity account is automatically created. After a user logs into ThePatronEdgeOnline or creates an account in The Patron Edge Online, Blackbaud NetCommunity user records are automatically linked.

26 22 CHAPTER 2 Blackbaud NetCommunity users are created when a PatronEdgeOnline user does not have a Blackbaud NetCommunity account and lands on a PatronEdgeOnline page that is configured to include BBNCUserHandler.asp. For more information about this.asp page, see Installation and Configuration on page 1. Before you process Blackbaud NetCommunity sign-up request transactions in TheRaiser sedge, we recommend that integration runs between The Patron Edge and The Raiser s Edge to avoid duplicate records. For more information about integration, see Raiser s Edge NetCommunity Page on page 22. You can configure Blackbaud NetCommunity tabs, such as View Giving History and Update My Preferences, to appear on the User Profile page of a PatronEdgeOnline public website. Users can click these tabs to navigate to Blackbaud NetCommunity pages. For more information about how to configure these tabs, see Installation and Configuration on page 1. You can create navigation links from the Patron Edge Online public website to Blackbaud NetCommunity pages and vice versa. For more information, see Installation and Configuration on page 1. Use the PEO Auto-link process in the Users & Security section of Blackbaud NetCommunity to automatically link existing Blackbaud NetCommunity and Raiser s Edge records to PatronEdge records. You can also manually link users and create new Patron Edge records if necessary. For more information, see Link Records Process on page 25. When Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline is enabled, you must edit Blackbaud NetCommunity user information through ThePatronEdge when the user is linked to a Patron Edge Online account. A single shopping cart does not exist between The Patron Edge Online and Blackbaud NetCommunity. When items exist in a user s Patron Edge shopping cart and the user navigates from one program to another, a message appears to warn the user that the contents in the shopping cart may be lost. For information about how to customize this warning message, see Installation and Configuration on page 1. Raiser s Edge NetCommunity Page Before you process Blackbaud NetCommunity sign-up request transactions in TheRaiser sedge, we recommend that integration runs between The Patron Edge and The Raiser s Edge to avoid duplicate records. From the NetCommunity page in TheRaiser sedge, you can require integration and specify that a warning message appear if integration has not run. For more information about the NetCommunity page, see the Blackbaud NetCommunity & Raiser s Edge Integration Guide. For information about the link records process, see Link Records Process on page 25.

27 SINGLE SIGN-ON USER AND ADMINISTRATOR WORKFLOW 23 Establish Patron Edge integration requirement 1. In TheRaiser sedge, click NetCommunity on the Raiser s Edge bar. The NetCommunity page appears. 2. From the top right corner of the page, click Options. The NetCommunity Options screen appears.

28 24 CHAPTER 2 3. Under Options, select Patron Edge Integration from the treeview on the left. The Require integration checkbox appears on the right. 4. Select Require integration. When you select this, you specify that integration is required to run no more than 15 minutes prior to processing sign-up request transactions. If integration has not run, a warning message appears. When you do not select this checkbox, integration is not required but a warning message still appears. We recommend you check this checkbox to avoid duplicate records in The Raiser s Edge.

29 SINGLE SIGN-ON USER AND ADMINISTRATOR WORKFLOW To save this option and return to the NetCommunity page in TheRaiser sedge, click OK. Warning: For security reasons, when a Raiser s Edge user accesses transactions on the NetCommunity page, you cannot make changes to Options. If you attempt to open Options, a screen appears notifying you that users are in transactions. You cannot change options until all users exit transactions. In addition, if a user in The Raiser s Edge is editing options, other users can only access Options in read-only mode. When Options are read only, the OK and Cancel buttons are not available. Link Records Process To ensure a successful user experience with Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline, you must make sure your Blackbaud NetCommunity, Patron Edge, PatronEdgeOnline, and Raiser s Edge records are properly linked. First, specify role assignments and constituent codes to apply to new records that are added when this feature is enabled. Next, confirm links between existing records using PEO auto-link in BlackbaudNetCommunity. You can also manually link to and create new Patron Edge records if necessary. After you ensure all links are properly in place, you can begin to process and link new sign-up request transactions. Warning: If you delete a user record in BlackbaudNetCommunity that is linked to a PatronEdge record, the link between the two records is broken. Specify Role Assignments and Constituent Codes on page 25 Use PEO Auto-Link to Link Existing Records on page26 Manually Link Records on page28 Link and Process New Records on page31 Specify Role Assignments and Constituent Codes Before you add or link records, you must first specify role assignments and constituent codes to apply to new records that are added when Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline is enabled. When a user creates a new Patron Edge Online account, a Blackbaud NetCommunity account is automatically created. You can establish role assignments to apply to the new BlackbaudNetCommunity accounts upon creation. For more information about roles in Blackbaud NetCommunity, see the Users & Security Guide. You can also select a constituent code to apply to new Raiser s Edge records. When you process Blackbaud NetCommunity sign-up request transactions in TheRaiser sedge, and new Raiser s Edge records are created, the constituent code you select applies to new records. For more information about constituent codes in The Raiser s Edge, see the Constituent Data Entry Guide. Establish role assignments and constituent codes 1. From the administration site for Blackbaud NetCommunity, click Administration, Sites & settings. From the Sites & settings page, select the top-level item in the treeview on the left and click the Settings tab.

30 26 CHAPTER 2 2. Click the Patron Edge Online tab. Role assignment and consitituent code settings appear. 3. Under Role assignment, select the roles to assign new users. For more information about roles, see the Users & Security Guide. 4. Under Constituent code, select a constituent code to apply to a new Raiser s Edge record. A constituent code defines the relationship a constituent has with your organization and why the individual is in your database. 5. To save the settings, click Save. Use PEO Auto-Link to Link Existing Records Before you begin to use Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline, you must first link all existing Blackbaud NetCommunity and Raiser s Edge records to Patron Edge records. This ensures your database is up-to-date and helps prevent duplicate records. We recommend you use PEO auto-link to automatically link these records. From the Users page of the Blackbaud NetCommunity administration site, PEO auto-link automatically links existing Blackbaud NetCommunity and Raiser s Edge records to Patron Edge records. When you use PEO auto-link, if an existing Patron Edge record is not associated with PatronEdgeOnline login credentials, the process uses Blackbaud NetCommunity login credentials to create a Patron Edge Online user name and password. The process then adds the new login credentials to the existing Patron Edge record. Note: PEO auto-link creates links to existing Patron Edge records. The process does not create new Patron Edge records. If necessary, you can manually link to and create new Patron Edge records from Blackbaud NetCommunity. For more information about how to manually link records, see Manually Link Records on page 28.

31 SINGLE SIGN-ON USER AND ADMINISTRATOR WORKFLOW 27 Use PEO Auto-Link to link existing records 1. From the administration site for Blackbaud NetCommunity, click Users & security, Users. The Users page appears. 2. Click PEO Auto-link. A confirmation appears. 3. To begin the process, click OK. A processing page appears and lists the amount of records that successfully linked. 4. To return to the Users page, click Return.

32 28 CHAPTER 2 The Users page displays all Blackbaud NetCommunity records. Use the Filter by PEO link field to display records that are either linked or unlinked to ThePatronEdgeOnline. When unlinked records exist, you can manually create a link to ThePatronEdge or create and link to a new Patron Edge record if necessary. For more information, see Manually Link Records on page 28. Manually Link Records Before you begin to use Single Sign-On with Blackbaud NetCommunity and ThePatronEdgeOnline, you must first link all existing Blackbaud NetCommunity and Raiser s Edge records to Patron Edge records. This ensures your database is up-to-date and helps prevent duplicate records. We recommend you use PEO auto-link to automatically link these records. For more information about PEO auto-link, see Use PEO Auto-Link to Link Existing Records on page 26. At times, you may need to manually link to a PatronEdge record. You can manually link to an existing record, create and link to a new record, or break a link to a record. From the Users page in BlackbaudNetCommunity, you can edit an existing Blackbaud NetCommunity record and confirm the link to a PatronEdge record. Manually create and link to a new or existing Patron Edge record 1. From the administration site for Blackbaud NetCommunity, click Users & security, Users. The Users page appears. 2. Select a user and click Click here to edit this user. The User editor tab appears. Note: You cannot create a link to a deleted user record. If a user has been deleted, a message appears above the login name. For more information about how to restore a user, see the Users & Security Guide. If the user s account has been locked, a message appears above the login name. To allow the user to access the account, click Unlock.

33 SINGLE SIGN-ON USER AND ADMINISTRATOR WORKFLOW Under The Patron Edge Online, if the user is not currently linked to a PatronEdgeOnline record, click Create Link. A search screen appears. 4. Under Patron Edge Search Criteria, use the fields to search for an existing Patron Edge record. Results display under Patron Edge Search Results. You can view a user s ID, name, , and Patron Edge Online login information. 5. Select a record in the grid and click Save. The Blackbaud NetCommunity record is now linked with the Patron Edge record. 6. If the record you want does not appear under Patron Edge Search Results, you can create and link to a new Patron Edge record. From the search screen, click New Patron Edge User. A confirmation screen appears. 7. To create and link to a new Patron Edge record with Patron Edge Online login credentials, click OK.