Janrain SSO

Daniel Hartanto

Hi All,


Wanted to know if any of you might have implemented Janrain SSO within your Luminate Online site and perhaps are familiar with the issue described below and if there is known solution for it.

Description of issue: We are implementing Janrain SSO both on our Luminate Online DEV and Production environment. Setup works fine and added several Social Sign On Providers (Google+, Twitter,Facebook, Yahoo), of which all the login through them works fine on DEV. However when we port that on Production, Google does not seem to be able to reconnect back with Luminate Online post authentication in order for Luminate Online to associate that Google account with either existing one or creating new account within (it appears to skip that middle handshake portion and redirects you back to where you were -- as results on Production, Luminate Online seems to know that you are logged in but unable to retrieve who you are.


Thus with that said, I am wondering if we

• Should have separate Janrain Properties each for DEV and Production?  (Note: it seems unlikely (imho but could be wrong) given that only Google currently not working while other like Yahoo and Facebook works just fine on that single Janrain property that we shared. We have whitelisted all of our Luminate Online domains associated with both DEV and Production in case

Other than that what might be causing it to only affect Google SSO?


Thanks in advance for your insights, help and time!


p.s. Here are actual test URL of our implementation


On production (where Google+ SSO is affected)
https://donations.diabetes.org/site/SPageServer?pagename=daniel_testpg3


On our DEV (where all seems to work as intended)
https://secure2.convio.net/adapdev/site/SPageServer?pagename=daniel_testpg3


When you successfully logged in, you will see your first name listed within the paragraph below it "Hello, [[S1:first_name]]"


I even tried to exclude anything that might relate to the pagewrapper overheads with that appended '&pgwrap=n'  to no avail, the issue remains.


regards,

Daniel

Daniel Hartanto

Update #2--


Revising this statement within "Description of issue" within the original posting.

Luminate Online knows you are logged in but unable to retrieve who you are   -- this turns out to be caused by Luminate Online arbitrarily associate my gmail account to an existing account without prompting me (usually we would be presented by that 'gateway' JanrainLogin page and token that would prompt us if we are to create a new account or to associate to an existing Luminate Online account with that google account of ours).  And in our case, LO seems to link mine to an account that is of 'Administrator' Security Category hence giving the impression that it doesn't go anywhere post authentication with Google.


Strangely enough -- test by Blackbaud support personnel within the same page seems to not be affected; while our tests using several of our gmail accounts seems to be encountering this issue.


regards,

Daniel

Daniel Hartanto

Update #3 --


Found the culprit and it is currently being officially referenced as a bug  LO-4061 at this time of writing --

Description:

• When SSO is first initiated in DEV, and attempted in Production afterwards, Luminate Online seems to persistenly referenced the DEV ConsID of the account when attempting to associate it within the Production, hence instead of prompting us with the options to either create a new account or associate with existing one, it will automatically/arbitrarily link the SSO with the same existing DEV ConsID counterpart within Production that will often time belongs to other individuals instead.
  
  Saving grace at moment -- this behavior won't happened when SSO is first initiated on Production and attempted in DEV afterwards.
  
   
• Unbeknownst to me at least -- for what we thought to be 'same' account of an individual (same email, first name, last name) -- they are actually of different ConsID within DEV and Production
  
   
• Thus this seems to be more of LO/Janrain backend vs Google+ related, and with it, other SSO Providers could also be affected if the above (1st bullet point) is attempted/replicated
  
   

With that said, I am going to unpublish the test link on DEV given above on my initial posting so no one would attempt it on our DEV and that would later prevent them to be linked to their registered account counterpart in Production.



Other setup details note

==================

• We are using a single Janrain Property  ('Engage App') to be used for SSO login on both DEV and Production

 

regards,

Daniel