OpenLogin: PTA, SAML, and OAuth/OpenID

Transcription

1 OpenLogin: PTA, SAML, and OAuth/OpenID Ernie Turner Chris Fellows RightNow Technologies, Inc.

2 Why should you care about these features?

3 Why should you care about these features? Because users hate creating new online accounts

4 Pass Through Authentication (PTA) RightNow Technologies, Inc.

5 Purpose Single sign-on between your website and Customer Portal Your Contact Datastore Customer Portal DB

6 Flow Users logs in on your site User clicks link to CP Your site sends user data and redirect location to CP PTA endpoint Contact is created/updated, logged in, and sent to the redirect location

7 Flow <CP_Site>/ci/pta/login/redirect/{CP Page}/ p_li/{pta_data} CP Page = Page to take user after login Home Page: /ci/pta/login/redirect/home Answers List Page: /ci/pta/login/redirect/answers/list Custom Controller: /ci/pta/login/redirect/cc/yourcontroller/endpoint

8 Flow PTA_DATA = Base64 encoded contact data Query string format p_userid=login&p_ [email protected]... cf91c2vyawq9bg9naw4mcf9lbwfpbd1qzg9lq GV4YW1wbGUuY29t Username is only required field

9 PTA Data Name Password Address Fields Org ID Custom Fields Channel Fields

10 PTA Configuration RightNow Technologies, Inc.

11 PTA_ENABLED Will CP accept PTA requests?

12 PTA_EXTERNAL_LOGIN_URL Where should CP take the user when they ask to login? What is the page on your site where users login? %next_page% %session% mymainsite.com/login?nextpage=%next_p age%&session=%session%

13

14

15 PTA_SECRET_KEY What value should we use to authenticate the request? No Encryption: p_li_passwd Encryption: Used as encryption key, don t send in URL!

16 PTA_ERROR_URL If an error occurs during the login process, where should we redirect the user? %error_code% %session% mymainsite.com/ptaerror?code= %error_code%&session=%session%

17 PTA_ERROR_URL Missing PTA data Failed decoding Invalid PTA_SECRET_KEY Missing login Password length exceeded Login failed (bad username/password combo) Various encryption failure states

18 PTA_EXTERNAL_LOGOUT_SCRIPT_URL If a user clicks logout from within CP, where should we take them on your site to logout? If not set, logout link won t show %source_page% mymainsite.com/logout?next= %source_page%

19 PTA_EXTERNAL_POST_LOGOUT_URL <CP SITE>/ci/pta/logout If a user logs out from your site and you take them to the /ci/pta/logout URL, where should we take them afterwards?

20 PTA Encryption PTA_ENCRYPTION_METHOD Triple DES or AES (128, 192, 256 bit) PTA_ENCRYPTION_KEYGEN PTA_ENCRYPTION_PADDING Raw data -> Encrypt -> Base64 encode Do not send p_li_passwd!

21 PTA_IGNORE_CONTACT_PASSWORD Should we store a password for the contact? Requires use of encryption Removes password syncing problem and multi-interface problem

22 Hooks pre_pta_decode Run before any manipulation of PTA data pre_pta_convert Run after data has been decoded/decrypted and converted into an array [p_user_id] => jdoe [p_ ] => [p_postal_code] => etc

23 Additional Features rn:condition external_login_used standard/input/forminput allow_external_login_updates attribute

24 Additional Features

25 OAuth & OpenID RightNow Technologies, Inc.

26 Purpose Remove requirement for users to create new account Allow them to use existing web credentials from a trusted authority

27 Flow

28 Flow

29 Flow

30 Configuration FACEBOOK_OAUTH_APP_ID FACEBOOK_OAUTH_APP_SECRET TWITTER_OAUTH_APP_ID TWITTER_OAUTH_APP_SECRET

31 OpenLogin Widget Attributes controller_endpoint Prebuilt URL s for Facebook, Twitter, Google, Yahoo display_in_dialog Used by default in mobile redirect_url

32 How Data Is Stored Twitter/Facebook (oauth) Entry in contact2channel_type table Allows automatic use with Cloud Monitor Everything else (OpenID) Entry in openid_accounts table Stores unique endpoint for each contact

33 SSO SAML 2.0 Support RightNow Technologies, Inc.

34 Federated Authentication (SSO) Agent Desktop RightNow CX provides the capability of authenticating agents through the SAML protocol. SAML 2.0 protocol/http Post Binding RightNow agent desktop would be a service provider Identity Provider initiated login Agent profile determines SSO or manual authentication. Staff accounts have to be provisioned/updated through one of the API s

35 Federated Authentication (SSO) Agent Desktop Session 5 Agent Request Agent 3 Desktop Login 2 Identity Manager 1 Identity Sync Identity Provider Account 1 Provisioning 4 RightNow 1 ) Ongoing sync of identity to RightNow and IdP 2) Agent logs into Identity Manager 3) Agent requests Agent Desktop 4) IdP creates SAML assertion and sends to RightNow 5) Session is created and agent is logged in

36 Federated Authentication (SSO)- Customer Portal RightNow CX provides the capability of authenticating contacts through the SAML protocol. SAML 2.0 protocol/http Post Binding RightNow Customer Portal and RightNow Social would be service providers Identity Provider initiated login Contacts can be redirected to RightNow Social or RightNow Customer Portal after authentication. Configuration setting for error redirect Contacts have to be provisioned/updated through one of the API s

37 Federated Authentication (SSO) Customer Portal/Social Session 5 Contact Request CP or Social Page Login 2 3 Identity Manager 1 Identity Sync Identity Provider Contact 1 Provisioning 4 RightNow 1 ) Ongoing sync of identity to RightNow and IdP 2) Contact logs into Identity Manager 3) Contact requests Customer Portal/Social Page 4) IdP creates SAML assertion and sends to RightNow 5) Session is created and contact is logged in

38 SAML Transaction Steps (Customer Portal/Social) RightNow (Service Provider) User travels to CP or Social Page 1 User (Browser) Identity Provider 2 RightNow checks Customer Portal Configuration for authentication option RightNow validates SAML 3 6 Browser sends SAML Assertion to RightNow SAML Endpoint User logged into Customer Portal 5 Customer Portal redirects browser to config setting URL with redirect Parameter 3 Encoded SAML Assertion sent to browser 4 5 Identity Provider verifies session or authenticates user Identity provider generates SAML Assertion

39 Federated Authentication (SSO)- Customer Portal Quick Demo

40 Questions? RightNow Technologies, Inc.