Overview

With our solutions, we aim to minimize barriers to learning and when a user has to remember security credentials for multiple systems, it can create a barrier and reduce utilization. To help with this challenge, we can configure Token Authentication. Many clients use an intranet portal or another web-based application that can be configured to work with a BizLibrary service that will provide a Single Sign-On like experience.

Goals

• Reduce barriers for users.
• The client intranet portal is the controlling entity for identifying the current user and authentication pattern.
• Implement a solution that utilizes industry accepted best security practices.

Example Flow

1. User A goes to their intranet site and they are presented with a link to the BizLibrary learning platform.
2. The user clicks on the link.
3. The link goes to a custom location on the intranet site that interacts with the BizLibrary service.
4. The intranet site redirects the user to a unique URL with a token for access.
5. The learning platform checks the token and authenticates the user.

The client’s system is responsible for:

• Identifying the current user.
• Implementing code and functions that interact with the BizLibrary service.
• Configuring access keys and access key changes according to BizLibrary security standards. If configured clients do not comply, the access keys will be disabled.

BizLibrary will:

• Provide clients with example code in C# ASP.NET and PHP that will interact with the BizLibrary service.
• Request changes to the client access keys according to BizLibrary security standards.
• Trust the client application to determine the current user and allow the user access.
• Protect against multiple use of the same authentication token.
• Only interact with client applications via HTTPS with the latest generally accepted web security standards.

Detailed Description

This section intended for the client development teams.

The token authentication service requires the following fields to be posted when submitted:

Upon successful login, the user will be redirected to the specified (“redirect_url”) page. If this value is not specified, they will be redirected to their default landing page. If there is an error processing the request, the application will throw a 401 – Access Denied error. To troubleshoot this error, the user can attempt to login to the site directly (https://lms.bizlibrary.com/) or have an administrator check to ensure that the username is active and exists in the system.

Client Configuration Values

Additional Information

Example code (written in ASP.NET C#):

<%@ Page Language="C#" AutoEventWireup="true" %>

<%@ Import Namespace="System.Collections.Specialized" %>

<%@ Import Namespace="System.Net" %>

<%@ Import Namespace="System.Security" %>

<%

    DateTime epoch = new DateTime(1970, 1, 1);

    DateTime now = DateTime.UtcNow;

    TimeSpan sinceEpoch = now.Subtract(epoch);

    string lmsSSOUrl = "https://lms.bizlibrary.com/Services/SSO";

    NameValueCollection formData = new NameValueCollection();

    formData["accesskey"] = "TESTSSO";

    formData["accesssecret"] = "512300AA59AD4DXYZ623226728AB575B";

    string username = Page.User.Identity.Name;

    if (username.IndexOf("\\") > -1)

    {

        username = username.Substring(username.IndexOf("\\") + 1);

    }

    formData["username"] = username;

    formData["look"] = "look";

    formData["redirect_url"] = "//Home";

    formData["time"] = sinceEpoch.TotalSeconds.ToString();

    using (WebClient webClient = new WebClient())

    {

        try

        {

            byte[] responseBytes = webClient.UploadValues(lmsSSOUrl, "POST", formData);

            Response.Redirect(System.Text.Encoding.UTF8.GetString(responseBytes));

        }

        catch (WebException exception)

        {

            string responseText;

            using (var reader = new System.IO.StreamReader(exception.Response.GetResponseStream()))

            {

                responseText = reader.ReadToEnd();

            }

            Response.Write(responseText);

        }

    }

%>

Additional Information

Example code (written in PHP):

<?php

// Set variable "live" = 1 for production, 0 to debug the response and not redirect

$live = 1;

$lmsSSOUrl = "https://lms.bizlibrary.com/Services/SSO";

$fields = array(

    'accesskey'     => 'ABCSSO',

    'accesssecret'  => 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',

    'username'      => $row_user['account_username'] . '@Test.com',

    /*

        or use authenticated user

        an authenticated user on your server

        'username' => $_SERVER['AUTH_USER'],

    */

    'look'          => 'test',

    'redirect_url'  => '/Home',

    'time'          => time()

);

$ch = curl_init();

$fields_string = '';

foreach ($fields as $key => $value) {

    $fields_string .= $key . '=' . urlencode($value) . '&';

}

$fields_string = rtrim($fields_string, '&');

// Set the URL, number of POST vars, POST data

curl_setopt($ch, CURLOPT_URL, $lmsSSOUrl);

curl_setopt($ch, CURLOPT_POST, count($fields));

curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

// Execute POST

$result = curl_exec($ch);

if ($live == 1) {

    // Redirect user to the response result URL

    header("Location: $result");

} else {

    echo "Response from server: $result<br /><br />";

    echo 'Server info <br /><br />';

    echo 'Session info <br /><br />';

}

// Close connection

curl_close($ch);

?>