whose username/password goes into the getSingleSignOn API Call

Corey Pudhorodsky:

You may consider checking out the alternative method for SSO Authentication in Convio posted at the following community document post:

http://community.customer.convio.com/docs/DOC-1739

Most people find this approach much easier to understand and implement. It allows you to authenticate the user with Convio as the "master" system while still having access to the external system.

To directly answer your question about the API, the "Use Convio API" permission is an administrative permission and should not be added to groups that end users belong to. Admin users that belong to groups with this permission will not be able to login through the admin console because the permission limits them to accessing the data via api calls.

Is there a similar pdf document that explains in detail the process described here

If not please please let me know what I'm doing wrong in the following steps below:

1) A user enters their username/password in the login form. The login form points to a script on my server

2) In the server I use the getSingleSignOn API call to get the authentication token. Now I did not use the username/password from the login form to do this. Instead I used the API user I created in the admin section to make this API call. The process for creating the admin user is described here:

Was I wrong in using the API admin user to get the authentication token? Was I supposed to use the username/password from the login form?

3) Now I have successfully retrieved an authentication token using the admin user I created. Now how do I authenticate the username/password from the login form??

Corey Pudhorodsky:

To answer this question, it might be best to go back to the question in your original post:

My question is: Apart from just a simple username/password I also have to pass their constituent id.

The problem is I have no way of knowing the constituent id - Am I supposed to save this information in a db and retrieve it everytime they try to log in?

The assumption here is that you have authenticated the user with your local server's login and password and the relationship between the Convio contact and your server's contact record that you are using to authenticate is already established (via data sync or prior registration). Since you have the token from the GeToken method, you can then use the singleSignOn method to log the client user onto the Convio site.

To troubleshoot or test with the code that you already have written, try passing the contact ID for a Convio end user via the GetToken API and then use that token on a client call to establish the session with the Convio server. Then the client should be able to view Convio pages as if they had logged in through the Convio login page.

Quick question on the document Corey:

Is the Form action url the same as ??

In other words what is the url of the user login servlet that sits on Convio?

Corey Pudhorodsky:

You should use the http://www.foo.org/site/UserLogin URL to authenticate the user in all cases. When necessary, the site will redirect the user to a secure (https://secure2.convio.net/foo...) page to process the request. For the purpose of the user login, always direct to the http://www.foo.org/site/UserLogin where "foo" is the short name for your site.

Thanks for you prompt reply Corey

what is the url that I need to redirect to on the Convio site

You started writing it out but ended with ...

Corey Pudhorodsky:

Don't worry about the secure link, I included the .. to indicate that there could be a number of pages that are secured.

The link that you should be redirecting to is: http://www.foo.org/site/UserLogin where foo is equal to the short name of your site.

I guess I'm not understanding what is then

There's no path on my site that corresponds to

Is UserLogin a script that I can download or is it a script that does API calls or does the redirecting?

Corey Pudhorodsky:

I suspect your case is a little unique since you are still in deployment and your DNS has not been fully configured.

You can also use: http://foo.convio.net/site/UserLogin where "foo" is the short name of your site. Later, the domain which you are directing to your Convio site would also work in replace of "foo.convio.net".

By the way the pdf document shows the login form as:

<form method="post" action="http://www.foo.org/site/UserLogin">

<input type="text" name="USERNAME" id="USERNAME" maxlength="60" />

<input type="password" name="Password" id="Password" maxlength="20" />

<input type="hidden" name="NEXTURL" id="NEXTURL" value="http://www.foo.org/site/PageServer?pagename=sso_redirect" />

value="http</form>

shouldn't it be:

<form method="post" action="http://foo.convio.net/site/UserLogin">

<input type="text" name="USERNAME" id="USERNAME" maxlength="60" />

<input type="password" name="Password" id="Password" maxlength="20" />

<input type="hidden" name="NEXTURL" id="NEXTURL" value="http://foo.convio.net/site/PageServer?pagename=sso_redirect" />

</form>

DavidHart :

Hi Kofi,

I'm really sorry for all the confusion we've created for you and glad to see that it looks like you're making good progress now.

The "foo.convio.net" style domain names are created as "staging" site names and are typically used only during the preparation of your site. Then once the site goes live, we will switch it over to use a more branded domain (aka www.foo.org) as the preferred domain name within our system. A few customers continue using the convio.net domains even after they have gone live. For customers who do have a branded domain, both domains will continue to work, but in general you want to phase out the use of the convio.net URLs quickly. In particular, if you are using the APIs and potentially domain level cookies that you want to share between the Convio site and other systems, you will need to use your own domain name.

Net net is that for now, you need to use your staging site name, but you should write your code to pick up the domain name from a single reference (property file or constant in the code). This way, you can quickly change it once you do go live with a branded URL.

Also are there any administration setups that I need to complete to do "Single Sign-On with Signed URL Redirects". Please point me to documentation that shows me how.