Single Sign-On (SSO) Release Notes Spring, 2010

Transcription

1 Single Sign-On (SSO) Release Ntes Spring, 2010 Cntents SSO Functinality Changes in Learning Platfrm 4.0 GUIDs SOAP FORM SSO Lgin Cnfiguratin Variable Cpyright 2010 by Desire2Learn Incrprated. Desire2Learn and its related lgs are registered trademarks f Desire2Learn Incrprated.

2 Single Sign-On (SSO) Release Ntes SSO Functinality Changes in Learning Platfrm 4.0 SSO Functinality Changes in Learning Platfrm 4.0 Single sign-n (SSO) functinality changes have been made t Learning Platfrm 4.0 in rder t make SSO mre secure. While the underlying SSO architecture remains the same, the fllwing changes have been made: A new glbally unique identifier (GUID) versin (Versin 2) and a crrespnding new GUID web service have been added. See sectins GUIDs and fr mre infrmatin. The main SSO lgin entry pint has changed frm the previus ASP page t a new.d2l page (sslgin.d2l). See sectin SSO Lgin fr mre infrmatin. Nte The SSO functinality is backwards cmpatible, s existing integratins using the previus GUID still wrk. GUIDs There are tw versins f the GUID: Versin 1: pre-learning Platfrm 4.0 GUIDs Nte Desire2Learn des nt recmmend that SSO integratins use this versin due t security vulnerabilities. Versin 2: new (mre secure) GUIDs Nte Desire2Learn recmmends that all new SSO integratins use Versin 2 f the GUID. Versin 2 is based n Versin 1 in terms f the GUID layut, but imprves n security facilities (like encryptin and digital signature). The previus D2L.GUIDs assembly and the previus GUID web service bth issue Versin 1 GUIDs. Learning Platfrm 4.0 cmes with a new GUID web service that can issue either Versin 2 r Versin 1 GUIDs (depending n the cnfiguratin). Nte There is n ther way t btain the Versin 2 GUID ther than thrugh the GUID web service by Desire2Learn Incrprated. All rights reserved 2

3 Single Sign-On (SSO) Release Ntes The new GUID service is an active server methd (ASMX) web service. This web service has the fllwing tw endpints: SOAP FORM The security in the GUID web service uses shared secret. The caller f the service needs t supply the shared secret that, in turn, is then matched t the cnfigured shared secret fr that rg. The GUID web service has the fllwing tw methds: GenerateExpiringGuid This methd takes the GUID type, rg ID, instance cde, TTL, user data, and shared secret and generates an expiring GUID. ValidateGuid This methd takes the GUID, GUID type, rg ID, instance cde, user data, and shared secret and validates the GUID. SOAP It is cmpliant with WS-I Basic 1.1 (the same as ASMX). The SOAP endpint can be accessed at the fllwing URL: Example Request POST /d2l/tls/lgin/d2l.guid.2.asmx HTTP/1.1 Hst: lcalhst Cntent-Type: text/xml; charset=utf-8 Cntent-Length: length SOAPActin: " <?xml versin="1.0" encding="utf-8"?> <sap:envelpe xmlns:xsi=" xmlns:xsd=" xmlns:sap=" <sap:bdy> <GenerateExpiringGuid xmlns=" <guidtype>sso r Exprt r Imprt r Verify r AssetGrabber r UserEnrllment r FederatedSearch</guidType> <rgid>string</rgid> <installcde>string</installcde> <TTL>int</TTL> 2010 by Desire2Learn Incrprated. All rights reserved 3

4 Single Sign-On (SSO) Release Ntes <data>string</data> <key>string</key> </GenerateExpiringGuid> </sap:bdy> </sap:envelpe> Example Respnse HTTP/ OK Cntent-Type: text/xml; charset=utf-8 Cntent-Length: length <?xml versin="1.0" encding="utf-8"?> <sap:envelpe xmlns:xsi=" xmlns:xsd=" xmlns:sap=" <sap:bdy> <GenerateExpiringGuidRespnse xmlns=" <GenerateExpiringGuidResult>string</GenerateExpiringGuidResult> </GenerateExpiringGuidRespnse> </sap:bdy> </sap:envelpe FORM The FORM endpint can be accessed at the fllwing URL: It accepts an HTTP POST request with the parameters URL (FORM) encded in the bdy f the request and returns an XML encded result. Nte Make sure t set the Cntent-type request header t applicatin/x-wwwfrm-urlencded. Example Request POST /d2l/tls/lgin/d2l.guid.2.asmx/generateexpiringguid HTTP/1.1 Hst: lcalhst Cntent-Type: applicatin/x-www-frm-urlencded Cntent-Length: length guidtype=string&rgid=string&installcde=string&ttl=string&data=string&key= string 2010 by Desire2Learn Incrprated. All rights reserved 4

5 Single Sign-On (SSO) Release Ntes SSO Lgin Example Respnse HTTP/ OK Cntent-Type: text/xml; charset=utf-8 Cntent-Length: length <?xml versin="1.0" encding="utf-8"?> <string xmlns=" SSO Lgin The user wh needs t g int a Learning Platfrm-based applicatin withut having t lg in (i.e. pass in his username and passwrd credentials) needs t g in thrugh a special lgin page called sslgin.d2l. This page is hsted at the fllwing URL: The sslgin page expects the fllwing request parameters: guid: This parameter is mandatry. rgid: This parameter is ptinal. It represents the target rg unit ID. userid: This parameter is ptinal (see Nte). It is the ID f the user that matches the user ID in the GUID. username: This parameter is ptinal (see Nte). It is the username that matches the username in the GUID. rgdefinedid: This parameter is ptinal (see Nte). It is the rg defined ID f the user that matches the rg defined ID in the GUID. actin: This parameter is ptinal. It is the actin that determines the destinatin URL. fferingcde: This parameter is ptinal. It is the rg unit cde that determines the target rg unit. Nte At least ne f userid, username, r rgdefinedid is mandatry. Requesting the sslgin page triggers the fllwing actins: Yur request parameters are validated. Yur GUID is validated against the ther request parameters. Yur destinatin is determined based n actin. Yur rg unit is determined based n fferingcde and user enrllment by Desire2Learn Incrprated. All rights reserved 5

6 Single Sign-On (SSO) Release Ntes Cnfiguratin Variable Cnfiguratin Variable The main cnfiguratin variable is the fllwing: d2l.system.trustedcnnectins.guidversin It is an rg level cnfig variable and affects which GUID versin is used fr bth generatin and validatin. The pssible values fr this variable are the fllwing: 1: Generate Versin 1 and validate nly Versin 1 2: Generate Versin 2 and validate nly Versin 2 Nte This is the default value 3: Generate Versin 2 and validate bth Versin 1 and Versin by Desire2Learn Incrprated. All rights reserved 6