Answers to: How to authenticate a user that is provided by a Single Sign On (SSO) proxy.

Comment by thienqh on Reto Weiss's answer

thienqh — Wed, 26 Apr 2017 06:18:31 -0400

I asked a new question for my problem http://answers.axonivy.com/questions/2597/how-to-set-information-for-logon-iuser-without-permanently-store-to-system

Comment by Reto Weiss on Reto Weiss's answer

Reto Weiss — Wed, 26 Apr 2017 02:44:49 -0400

No, there is no such API. IUser is always backed in the database. What is the use case? Setting the fullname from a SSO Proxy seems to be weird?

Comment by thienqh on Reto Weiss's answer

thienqh — Tue, 25 Apr 2017 07:06:03 -0400

Hi Reto, After I retrieved the IUser by using:

IUser user = ivy.session.getSecurityContext().findUser(userName);

then set some basic information for this user likes

user.setFullName("MyFullname");

It seem override the information of User in database also. I wonder if there is any API to working with IUser without affect to the database?

Comment by ahatius on Reto Weiss's answer

ahatius — Tue, 28 Jan 2014 10:10:59 -0500

I'll check this with our SSO guys, there seems to be a tomcat-sso integration :)

Answer by Reto Weiss

Reto Weiss — Mon, 27 Jan 2014 11:33:10 -0500

Xpert.ivy uses internally an embedded Tomcat web server. Maybe your SSO-Proxy delivers support for Tomcat (e.g. a Tomcat valve or realm or filter) so that Tomcat can use the user information from your SSO Proxy and provides them to the deployed web applications. Xpert.ivy is such a deployed web application and will read the user information provided by Tomcat. If there is an Xpert.ivy user that has the same name as the one provided by Tomcat it will automatically authenticated the user without any further configuration or logic necessary.

Overview how this works:

Client -> SSO-Proxy -> Tomcat -> SSO-Proxy-Valve -> Xpert.ivy

SSO-Proxy: Delivers user name in UID http parameter

SSO-Proxy-Value: Reads UID parameter and sets user principal on the tomcat request

Xpert.ivy: Reads the user principal from the tomcat request and lookup a Xpert.ivy user with the same name. If it founds one it will be authenticate on the session automatically.

This works similar to SSO with IIS described in the Server Guide. The main difference is that you have to install and configure the SSO-Proxy specific Tomcat value, realm or filter. The corresponding tomcat configuration files are located at:

/webapps/ivy/WEB-INF/web.xml
/webapps/ivy/META-INF/context.xml

However, there is also an API to do something similar in your process:

import ch.ivyteam.ivy.security.IUser;

String userName = ivy.request.getParameter("UID").toString();
IUser user = ivy.session.getSecurityContext().findUser(userName);
ivy.session.authenticateSessionUser(user, "SSO-Proxy");