Single Sign On Integration Guide

User login

Authenticate swiftly and securely with your trusted identity provider. Experience a seamless login process, bypassing the need to remember another set of credentials. Enjoy the enhanced security provided by your identity provider’s robust authentication measures. This is the convenience and security of Single Sign-On.

How it works

1. Initiate authorization

This step occurs in the user’s browser.

• Initiate Authorization: Your application redirects the user’s browser to the identity provider’s authorization endpoint (/v2/authorize).
• User Login: The user enters their credentials and logs in on the identity provider’s page.
• Two-Factor Authentication (2FA): If enabled, the user completes the second factor (e.g., entering a code sent to their mobile device).
• Return to Application: Post successful login and 2FA verification, the user’s browser is redirected back to your application using the predefined redirect URL.

Sample request:

curl -G https://eu-test.oppwa.com/sso/v2/authorize \
 -d "client_id=8a829418504762810150482b9432129d" \
 -d "redirect_uri=https://www.payunity.com/tutorials/openid" \
 -d "scope=openid" \
 -d "response_type=code" \
 -d "login_hint=8ac7a4c79394bdc801939736f17e063d" \
 -d "state=dcc05834-018b-451f-bda0-ef54b30eef46"

2. Acquire access token

This step is handled by your application’s server.

• Acquire Access Token: Your application makes a request to the identity provider’s token endpoint (/v2/token) and receives an access token.

Sample request:

curl https://eu-test.oppwa.com/sso/v2/token \
 -d "code=" \
 -d "redirect_uri=https://www.payunity.com/tutorials/openid" \
 -d "scope=openid" \
 -d "grant_type=authorization_code" \
 -H "Authorization: Basic OGE4Mjk0MTg1MDQ3NjI4MTAxNTA0ODJiOTQzMjEyOWQ6cDBLdVNFU0pmLUpBWnl0NXN1UVY="

3. Retrieve user information

This step is also handled by your application’s server.

• Retrieve User Information: Your application uses the access token to query the identity provider’s user information endpoint (/v2/userinfo).
• User Login Confirmation: Based on the received information and your application’s rules, decide whether to grant the user access.

Sample request:

curl -G https://eu-test.oppwa.com/sso/v2/userinfo \
 \
 -H "Authorization: Bearer <access-token>"

Session Tracker

Experience the power of real-time session tracking in Single Sign-On (SSO). Our session tracker keeps you informed about the user’s active status in the Authentication Manager and any logout actions from connected applications. Upon logout, your application receives an instant alert, enabling swift response. Post-action, your application is ready to initiate a new Login Workflow, ensuring a smooth transition for potential user re-login. Discover enhanced control and fluid user management with our session tracker in SSO.

• User logs into your application via the Login Workflow.
• User navigates to a different application, like the Open Payment Platform.
• User logs out, activating the Logout workflow on the visited application.
• User accesses an internal page in your application. The Session Tracker JavaScript Snippet promptly alerts your application about the session change.
• Your application swiftly terminates the local user session and readies a new Login Workflow.

How it works

1. Responding to logout events

Your application can receive notifications about changes in the user’s remote session (on the Authentication Manager) by embedding a JavaScript Snippet on each page of your application. This allows your application to take action, such as terminating the local user session and initiating a new Login Workflow.
Please add the following JavaScript code to each page of your application that needs to respond to remote logout events:

<script type="text/javascript">
(function(w, d, o, u, r, a, m)  {
	w[r] = w[r] ||
		function() {
			(w[r].q = w[r].q || []).push(arguments);
	};
	a = d.createElement(o),
	m = d.getElementsByTagName(o)[0];
	a.async = 1;
	a.src = u;
	m.parentNode.insertBefore(a, m);
})(window, document, 'script', 'https://eu-test.oppwa.com/sso/sessionTracker/oasm.js', '_OASM');
 
//put your client id instead of {your_client_id}
_OASM('client_id', '{your_client_id}');
 
//callback for whenever the session status is different than expected
_OASM('on_change', function(){
	//remove user session locally
	//start a new Login Workflow
});
</script>
			

2. Verifying user login status (individual check)

After integrating the above script into your page, your application can perform individual checks to see if the user has remotely logged out. If the remote login status of the user is not as expected (‘logged_in’), your application will be notified via the function defined by _OASM('on_change').

_OASM('check', 'logged_in');

3. Verifying user login status (polling)

Your application can also set up a polling mechanism that continually verifies at set intervals if the user has logged out.

// Set the interval (in milliseconds) at which your application should verify if the user has logged out.
_OASM('poll', {state:'logged_in', interval: 10000});
			

User logout

Authenticate swiftly and securely with your trusted identity provider. Experience a seamless login process, bypassing the need to remember another set of credentials. Enjoy the enhanced security provided by your identity provider’s robust authentication measures. This is the convenience and security of Single Sign-On.

How it works

1. Terminate session

Redirect the user to the identity provider’s page to initiate the authorization process.

Sample request:

curl -G https://eu-test.oppwa.com/sso/v2/logout \
 -d "post_logout_redirect_uri=https://www.payunity.com/tutorials/openid"