Using SSO with a .NET system

David Hart

I've been working with lots of clients and partners to implement the Single SignOn using signed redirects described in http://community.customer.convio.com/docs/DOC-1739. One of the requirements for using this is that you have to be able to check the timestamp that is passed back to your system in the URL. Convio eCRM is a Java application so our natural format for a timestamp is milliseconds since 1/1/1970, but we thought that most sites that want to do SSO would be CGI or PHP based, so our standard implementation converts it to seconds since 1/1/1970 (i.e. divides by 1000) to put it in a format more natural to those environments.

A while back, I worked with a partner on SSO to a .NET system and wasn't sure what they would have to do to check our timestamp (not being a .NET programmer myself). This is the code snippet that they provided:

// Gets system time

DateTime dtNow = DateTime.UtcNow;

// Gets convio system time;

// Multiply by 1000 for milliseconds

Int64 longtime = Convert.ToInt64(Request.ToString()) * 1000;

// This long number here is the key to the conversion from a .NET datetime to one that actually starts at 1/1/1970

// without this number it calculates the new date time object to be the "longtime * TimeSpan.TicksPerMillisecond" from year 1/1/0001

//

DateTime convioUtcDt = new DateTime((longtime * TimeSpan.TicksPerMillisecond) + 621355968000000000);

// Get the hash string

string hash = CalculateMD5Hash(cons_id + t + Convio_Secret);

// Check the timestamp for within 15 minutes and the correct signature (adjust window based on your clock accuracy)

if((convioUtcDt > dtNow.AddMinutes(-15) && convioUtcDt < dtNow.AddMinutes(15)) && sig.Equals(hash))

// Your business logic for a valid request goes here