getSingleSignOnToken API Authentication question

DavidHart :

The URL that you want to call is ; that should work.

I also took a look at your API configuration on the back-end, and fixed the IP restriction.

If you are doing a single signon, you might also be interested in looking at a document that was recently posted http://community.customer.convio.com/docs/DOC-1739. It describes a simple SSO implementation where Convio is the master for authentication. We've had a lot of confusion around the getSingleSignOnToken API call lately. It's only appropriate in the case where you are providing the master server for authentication and you want the user to be logged in to the Convio powered site as well. This is pretty atypical for our customers.

Hello daveh,

I tried it again and it did not work. The url I'm sending to the convio servers looks like the url below:

https://secure2.convio.net/oxfam/site/SRConsAPI/?api_key=RANDOM_TEXT&v=1.0&method=getSingleSignOnToken&response_format=xml&login_name=LOGIN_NAME&login_password=LOGIN_PASSWORD&cons_id=CONTACT_ID&member_id=

The Convio server is still returning the "Site Not Found" page. I would at least like to get an XML formated error message. The funny thing is if I copy the url in a browser I get back an xml formated error message saying "Authorization failed." with error code "3".

Thanks for your help. I appreciate it.

DavidHart :

How are you invoking the API? If it is working from the browser then it is the right URL, and since you are getting our maintenance page it is getting to the right server (no DNS or firewall problems).

Note that this is https (secure) not http (insecure). If you are going to the same URL but with protocol http, you will hit the maintenance page. I just verified this in the browser.

The url is the one I posted in my previous post with the actual values replacing RANDOM_TEXT,LOGIN_NAME,LOGIN_PASSWORD and CONTACT_ID

Our server is a linux FreeBSDpython (using urlgrabber library)OpenSSL

Does the Convio server look for any special html headers from other servers? I ask that because I just tried to grab another https url (https://oaweb.projectpath.com/login) and the page was returned with no problems on the server

DavidHart :

We looked at logs on the web servers and at the application layer, and the only requests we could find for that URL were coming in from your browser and mine. I'm kind of stumped at this point.

There are no special headers required, and we'd still expect to see the request hit our web server logs.

If you can capture the request that you are sending from your server and send it to me over email, I may be able to see something. Unfortunately, I'm not going to be much help on the Python side.

Hmm.. that is pretty weird

Well I'm definately getting something back (http://service.convio.net/notfound.html) from your servers so I don't know what I could do on my end.

Does the server re-route my request to http://service.convio.net/notfound.html before or after it is processed

If the request cannot be found in the logs then it means it's being rerouted even before the request reaches https://secure2.convio.net/oxfam/site/SRConsAPI.

Can you please check the server logs on http://service.convio.net to see if the requests are there? If they are then my server is somehow replacing the https:// with http:// which doesn't make sense. I'll call our hosting providers to see if thats the case.

DavidHart :

We looked at logs on the web servers and at the application layer, and the only requests we could find for that URL were coming in from your browser and mine. I'm kind of stumped at this point.

There are no special headers required, and we'd still expect to see the request hit our web server logs.

If you can capture the request that you are sending from your server and send it to me over email, I may be able to see something. Unfortunately, I'm not going to be much help on the Python side.

Hello daveh,

I can now talk to the convio server. Yay. I'm still getting an athorization error but at least its a xml formatted so I know I'm on the right track.

For any future python users that may run into this post the problem was in the urlgrabber library - DO NOT USE IT

Just use the libcurl and pyCurl library from http://curl.haxx.se/

You'll save yourself a lot of headache - trust me