AnsweredAssumed Answered

aveksa/command.submit?cmd=loginUser with AuthSource=SSO

Question asked by Shlomo Katz on May 22, 2019
Latest reply on May 30, 2019 by Mostafa Helmy

Hello

Environment: 7.1.1 Patch 1

I am trying to get the loginUser token with the above command "https://.....aveksa/command.submit?cmd=loginUser&AuthSource=SSO"

Problem: When using AuthSource, (not using username/password tags) it returns "Error occurred logging user null in with authprovider"

Using <username></username><password></password> without AUTHSOURCE works.

We do use SSO to log in normally, so I know SSO is working generally.

Any ideas?

Correct Answer

There are two things to take care of when doing SSO SAML logins using the web services:

You need to actually perform a proper SAML authentication call first to your IdP (SSO Server).
- You would do an IdP-initiated login call first to get a SAML Assertion.
- Once you get a valid SAML Assertion, you need to pass it in the body of the login command as a x-www-form-urlencoded.
- For this part, if you do not have a lot of experience with SAML, I would suggest you involve someone from your SSO team as they would know how to do this using your local SAML IdP.

You need to configure an additional relying trust with your IdP to the webservices URL.
- Generally for the UI logins, your IdP would be setup for the URL https://.../aveksa/main
- However the web services URL is different https://.../aveksa/command.submit
- So your SSO team would need to configure a secondary relying trust for the web services URL.

No one else had this question

Outcomes