Using the Constituent and SSO API'

Kristine Amendola 2

We are creating a new Web site for our organization and are having trouble authenticating the passwords. Can someone help. Summary of problem below.

Using the Constituent and SSO API's, we are looking to setup a situation where FFB only needs 1 member database (at Convio) and to allow members to login to both the website and Convio via the website. The issue comes in when we are trying to log the user in. If we ask for an email and a password on the web, we can call getUser with the email address to get the appropriate cons_id to pass to getSingleSingOnToken. However, when examining the response of getUser, there is no password field included. Without a password we obviously cant authenticate the credentials to see whether or not to really log this user in. Is there any way to include the password in the getUser response? If it comes over encrypted, then we would also need to know what hash function (md5, sha, etc) you are using so we could run the same encryption on our end to get a match.

Thank you.

Kristine

Foundation Fighting Blindness

Jeff Mills

The initial SSO API methods were intended to support the scenario wherein the users' authentication credentials (user name and password) are managed on the non-Convio system. In this case, that system performs the authentication and then uses the SSO methods to automatically log the user into the Convio system.

To support the scenario that you describe, we've added a "login" method that accepts "user_name" and "password" parameters and performs the authentication against the Convio database. In addition to logging the user into the system it also returns the SSO token and cons_id. This will be available in the next release, which I think will be available sometime in August.

The APIs do not allow a user's password to be retrieved.