---
title: "Custom SSO Integration"
type: "wiki"
space: "Axero Documentation"
author: "Anonymous User"
created: 2017-05-16T19:05:51Z
updated: 2026-08-19T00:33:40Z
tags: ["site-administrator"]
url: "https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/22926/custom-sso-integration"
---

# Custom SSO Integration

Axero supports single sign on \(SSO\) for any custom SSO provider, regardless of the technology your existing website is built on, whether it's PHP, Java, ASP.NET, or another platform. The key requirement is that your website must be able to create and manage cookies.

User registration will take place on your existing website, which will serve as the central point for new user creation. To keep user information synchronized between your website and Axero, you can use the Axero REST API to ensure that all new users are also added to the Axero database. See [REST API Overview](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/370/rest-api-overview "REST API Overview").

Assumptions:

1. Your other website is at `http://www.existing-website.com`.
2. Your Axero site is at either a sub-domain \(`http://cf.existing-website.com`\) or in a sub-directory \(`http://www.existing-website.com/cf`\).

#### Configure Axero for SSO

Client-side setup is estimated to take 1-3 hours and Axero team setup is estimated to take 2-3 hours. The time to set up SSO can vary based on how long it takes to set up internal systems and to provide the Axero team with required information. The total time for setting up SSO may take up to 1-2 business days.

1. In the CFSSOSettings.config file in the installation directory of Axero, modify the <SingleSignOn> section. Below is an explanation of the <SingleSignOn> section. 

    ```
    <SingleSignOn Enabled="true"
                    CookieName="CommunifireUserCookie"
                    CookieDomain=".existing-website.com"
                    CookiePath="YOUR-SITE-PATH"
                    EncryptedCookie="true" 
                    EncryptionAlgorithm="AES"
                    InitVectorAES=""
                    EncryptionAlgorithmKey=""
                    EncryptionOption="All"
                    UsernameKey="CFUsername"
                    UserEmailKey="CFUserEmail"
                    ExternalLoginUrl="http://www.existing-website.com/login.asp"
                    ExternalRegistrationUrl="http://www.existing-website.com/register.asp"
                    />
    ```

    | **Key** | **Description** |
    | --- | --- |
    | Enabled | Set to *true* to enable SSO, *false* to disable. |
    | CookieName | The name of the cookie created by your application. We suggest using the default value of *CommunifireUserCookie*. |
    | CookieDomain | If you are using Axero in a subdomain, set this to the parent domain \(e.g. *.parent-domain.com*\), otherwise leave it empty. You can also use the IP address if you are using an IP instead of a domain. |
    | CookiePath | Set as "/" or the specific virtual directory path, such as "/web". |
    | EncryptedCookie | Specifies whether the data in the cookie \(both keys and values\) are encrypted or not.<br>Note: If you are encrypting your cookies, make sure you encode them before storing the values in the cookie. Do not store the cookies in the base64 encoded format. Instead, use the [HttpUtility.UrlEncode](https://learn.microsoft.com/en-us/dotnet/api/system.web.httputility.urlencode) and [HttpUtility.UrlDecode](https://learn.microsoft.com/en-us/dotnet/api/system.web.httputility.urldecode) methods to store the encrypted keys and values in the cookie. This is required because of a known issue with .NET handling base64 encoded strings as a cookie's key and value pair. |
    | EncryptionAlgorithm | Symmetrical algorithm used to encrypt the cookie. As of now, the only option available is AES. By default, AES is used \(keySize=128, hashAlgorithm=SHA1\). The value is case-sensitive and must be written exactly as *AES*. It only applies when *EncryptedCookie* is *true*. You can use your own AES implementation, but we recommend the built-in one: the *Communifire.Common.Security.Encrypt\(\)* and *Decrypt\(\)* methods, which ship in *Communifire.BL.dll* in your site's *bin* directory. |
    | InitVectorAES | Initialization Vector for the AES algorithm. Leave this empty if you are using the built-in *Communifire.Common.Security* class, which supplies the matching default. |
    | EncryptionAlgorithmKey | If you want to use your own custom key to encrypt the cookie, specify it here. Otherwise, the algorithm's default key is used if you leave this field empty. |
    | EncryptionOption | Set to *All*, which encrypts both the keys and the values. This is the only supported value, and it is case-sensitive. Any other value causes the cookie to be ignored and the visitor to stay signed out. This setting only applies when *EncryptedCookie* is *true*; an unencrypted cookie is read directly and ignores it. |
    | UsernameKey | The key used in the cookie to reference the value of the User's username. |
    | UserEmailKey | The key used in the cookie to reference the value of the User's email address. |
    | ExternalLoginUrl | The address of your existing website's login page. When this is set, the *Log in* links Axero renders point to it instead of to the Axero login page. Leave it empty to keep using the Axero login page even while SSO is on.<br>A visitor who arrives with no cookie is only sent to this address automatically when *Allow access only to registered members* is checked in [General Settings](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/22187/general-settings "General Settings"). On a community that allows guests, the visitor stays signed out and browses as a guest until they follow a *Log in* link. |
    | ExternalRegistrationUrl | Set this to your existing website's registration page if you want to use your own registration page. Otherwise, leave this empty if you want to use Axero's registration page. |

Note If you have checked *Allow access only to registered members* in [General Settings](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/22187/general-settings "General Settings"), then guests will not be able to view the community unless a valid cookie is found \(if SSO is turned on\), or they sign up and become members.
2. Configure your existing web application to create a cookie needed by Axero for SSO. Set the name of the cookie to the *CookieName* you specified in CFSSOSettings.config in step 1 \(it is *CommunifireUserCookie* by default\) and set its expiry date as per your requirements. In this cookie, write the user's username and email address \(using the key names as specified in step 1\).
3. Set the cookie's *Domain* property to the parent domain. For example, we set *Domain* to

    ```
    cookie.Domain = ".existing-website.com";
    ```
4. Make sure that the CFSSOSettings.config file in the Axero installation directory has the same settings as the cookie you created.
5. Recycle the application pool for the Axero site. CFSSOSettings.config is read once and then held in memory, so edits to the file do not take effect until the site restarts or its cache is cleared. Testing before the recycle shows the old settings.

#### Single Sign-On Workflow

1. User comes to the Axero community website/application.
2. Axero checks for a cookie saying the person is already signed in at the *parent* website \(`www.existing-website.com`\).
3. If no cookie is found, then the user is treated like a guest user \(un-authenticated user\).
4. At this point, the person can either sign in to the existing parent website or register as a new user.
5. Once the person has signed in to your existing site, create the cookie as mentioned in the above steps.
6. Redirect the user to the Axero sub-domain with the appropriate cookie.
7. Axero will check for the cookie \(step 2\) and if the cookie is found, it will check the Username and UserEmail key values and find the user based on these values. If the user is found, the person is signed in automatically.

#### Sample Code to Create the Cookie from Your Application

```
//Create encrypted cookie
Communifire.Common.Security sc = new Security();
sc.PassPhrase = "externalcookie";
string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername"));
string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail"));
string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt("USER_NAME_GOES_HERE"));
string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt("USER_EMAIL_GOES_HERE"));

HttpCookie cfCookie = new HttpCookie("CommunifireUserCookie");
cfCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
cfCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
cfCookie.Expires = DateTime.UtcNow.AddDays(30);
cfCookie.Domain = ".your-exisiting-domain.com";
HttpContext.Current.Response.Cookies.Add(cfCookie);
```

**The sample above is .NET Framework.** `HttpCookie` does not exist in ASP.NET Core, so on .NET Core or later \(including .NET 8 and Blazor apps\) the equivalent is `Response.Cookies.Append` with a `CookieOptions` object. The encryption and the key names are unchanged; only the way the cookie is written differs.

```
var options = new CookieOptions
{
    Domain = ".your-existing-domain.com",
    Expires = DateTimeOffset.UtcNow.AddDays(30),
    Secure = true,
    SameSite = SameSiteMode.None,
    Path = "/"
};

var value = $"{encryptedUserNameKey}={encryptedUserName}&{encryptedEmailKey}={encryptedUserEmail}";
Response.Cookies.Append("CommunifireUserCookie", value, options);
```

**Two things about the domain and the browser.** Write the cookie for the *parent* domain, with the leading dot as shown, so it is shared between your application and the Axero subdomain. A cookie written for one subdomain is not visible to the other, which is the usual reason a correctly encrypted cookie appears to be ignored.

And where the two sites are on different domains rather than subdomains of one, modern browsers require `SameSite=None` together with `Secure`, so the cookie must be sent over HTTPS or it will be dropped without warning.

**&lt;SingleSignOn&gt; section in CFSSOSettings.config**

```
  <SingleSignOn Enabled="true"
                CookieName="CommunifireUserCookie"
                CookieDomain=".your-exisiting-domain.com"
                CookiePath="/site"
                EncryptedCookie="true"
                EncryptionAlgorithm="AES"
                InitVectorAES=""
                EncryptionAlgorithmKey="externalcookie"
                EncryptionOption="All"
                UsernameKey="CFUsername"
                UserEmailKey="CFUserEmail"
                ExternalLoginUrl="http://your-existing-website.com/login.asp"
                ExternalRegistrationUrl="http://your-existing-website.com/register.asp"
                />
```

Note If you cannot reference *Communifire.BL.dll*, see the Custom SSO Cookie Encryption section at the end of this page for instructions on using your own encryption method.

#### Post-Login Landing Page

You can specify the page the user is they are sent to after signing in, by setting [General Settings](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/22187/general-settings "General Settings") &gt; [Site Settings](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/22188/site-settings "Site Settings") &gt; Post login landing page.

Additional localhost steps

**Host file \(%WINDIR%\System32\drivers\etc\hosts\) code**

```
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
    127.0.0.1       localhost cftesting.com
```

**In IIS:**

Make the following virtual directories under the default application \(e.g. `http://cftesting.com/`\):

1. Axero \(e.g. `http://cftesting.com/communifire/`\)
2. ExternalLoginSite \(e.g. `http://cftesting.com/ExternalLoginSite/`\)

![](http://my.axerosolutions.com/Assets/Uploaded-CMS-Files/1-4676899a-857f-4d61-b68d-709fa6d8acbf.png)

The Axero site is where the Axero application itself is installed. ExternalLoginSite is the site where your external login page is located. Users will enter their credentials at the external site and then be redirected to the Axero site.

**Axero site's CFSSOSettings.config code**

```
<?xml version="1.0"?>
<SingleSignOn Enabled="true"
              CookieName="CommunifireUserCookie"
              CookieDomain=".cftesting.com"
              CookiePath="/"
              EncryptedCookie="true"
              EncryptionAlgorithm="AES"
              InitVectorAES=""
              EncryptionAlgorithmKey="externalcookie"
              EncryptionOption="All"
              UsernameKey="CFUsername"
              UserEmailKey="CFUserEmail"
              ExternalLoginUrl="http://cftesting.com/ExternalLoginSite/login.aspx"
              ExternalRegistrationUrl=""
                />
```

**ExternalLoginSite's login.aspx code**

Note This sample is a local test harness, so it writes a fixed email address into the cookie. In a real deployment, pass the signed-in person's own email address instead. Axero compares the cookie's email against the account's email and ignores the cookie if they differ.

```
<%@ Page Language="C#" AutoEventWireup="true"  %>

<%@ Import Namespace="Communifire.Common" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
    <asp:Login ID="Login1" runat="server" OnAuthenticate="Login1_Authenticate">
    </asp:Login>
    </form>
</body>
</html>

<script runat="server" language="C#">

    protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
    {
        Communifire.Common.Security sc = new Security();
        sc.PassPhrase = "externalcookie";
        string encryptedUserNameKey = Server.UrlEncode(sc.Encrypt("CFUsername"));
        string encryptedEmailKey = Server.UrlEncode(sc.Encrypt("CFUserEmail"));
        string encryptedUserName = Server.UrlEncode(sc.Encrypt(Login1.UserName));
        string encryptedUserEmail = Server.UrlEncode(sc.Encrypt("admin@admin.com"));

        HttpCookie fakeCookie = new HttpCookie("CommunifireUserCookie");
        fakeCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
        fakeCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
        fakeCookie.Path = "/";
        fakeCookie.Domain = ".cftesting.com";
        HttpContext.Current.Response.Cookies.Add(fakeCookie);

        FormsAuthentication.SetAuthCookie(encryptedUserNameKey, false);
        Response.Redirect(Request.QueryString["ReturnUrl"]);

    }

</script>
```

Additional subdomain steps

Let's assume your parent site is *parentsite.com* and the subdomain is *sub.parentsite.com.* Below are the recommended settings.

**parentsite.com web.config**

```
    <authentication mode="Forms">
        <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" />
    </authentication>
```

**sub.parentsite.com web.config**

```
<authentication mode="Forms">
        <forms loginUrl="login" 
               name=".subASPXAuth" 
               domain="sub.parentsite.com" />
    </authentication>
```

**SSO cookie creation code**

```
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" };
string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername"));
string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail"));
string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username));
string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt(userEmail));

var ssoCookie = new HttpCookie("CommunifireUserCookie");
ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
ssoCookie.Domain = ".parentsite.com";
ssoCookie.Expires = DateTime.Now.AddMonths(1);
HttpContext.Current.Response.Cookies.Add(ssoCookie);
```

The SSO cookie creation code should be placed after the user clicks the login button after entering correct credentials.

*username* and *userEmail* are the values for the person the SSO cookie is being created for. *username* must match that person's username or email address in Axero. *userEmail* must match their email address in Axero exactly, including capitalization; if it does not match, Axero ignores the cookie and the person stays signed out. If you want to create a non-persistent SSO cookie, you must remove *ssoCookie.Expires = DateTime.Now.AddMonths\(1\);* in the code above.

You should add all Communifire.\*.dll files to the *bin* directory of your parent site.

**CFSSOSettings.config**

```
<?xml version="1.0"?>
<SingleSignOn Enabled="true"
              CookieName="CommunifireUserCookie"
              CookieDomain=".parentsite.com"
              CookiePath="/"
              EncryptedCookie="true"
              EncryptionAlgorithm="AES"
              InitVectorAES=""
              EncryptionAlgorithmKey="externalcookie"
              EncryptionOption="All"
              UsernameKey="CFUsername"
              UserEmailKey="CFUserEmail"
              ExternalLoginUrl="http://parentsite.com/login.aspx"
              ExternalRegistrationUrl=""
                />
```

Additional subdirectory steps

Let's assume your parent site is *parentsite.com* and the subdirectory is *parentsite.com/community.* Below are the recommended settings.

**parentsite.com web.config**

```
    <authentication mode="Forms">
        <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" />
    </authentication>
```

**SSO cookie creation code**

```
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" };
string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername"));
string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail"));
string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username));
string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt(userEmail));

var ssoCookie = new HttpCookie("CommunifireUserCookie");
ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
ssoCookie.Domain = ".parentsite.com";
ssoCookie.Expires = DateTime.Now.AddMonths(1);
HttpContext.Current.Response.Cookies.Add(ssoCookie);
```

The SSO cookie creation code should be placed after the user clicks the login button after entering correct credentials.

*username* and *userEmail* are the values for the person the SSO cookie is being created for. *username* must match that person's username or email address in Axero. *userEmail* must match their email address in Axero exactly, including capitalization; if it does not match, Axero ignores the cookie and the person stays signed out. If you want to create a non-persistent SSO cookie, you must remove *ssoCookie.Expires = DateTime.Now.AddMonths\(1\);* in the code above.

You should add all Communifire.\*.dll files to the *bin* directory of your parent site.

**parentsite.com/community web.config**

```
<authentication mode="Forms">
        <forms loginUrl="login" 
               name=".subASPXAuth" 
               domain="parentsite.com" path="/community"/>
    </authentication>
```

**CFSSOSettings.config**

```
<?xml version="1.0"?>
<SingleSignOn Enabled="true"
              CookieName="CommunifireUserCookie"
              CookieDomain=".parentsite.com"
              CookiePath="/"
              EncryptedCookie="true"
              EncryptionAlgorithm="AES"
              InitVectorAES=""
              EncryptionAlgorithmKey="externalcookie"
              EncryptionOption="All"
              UsernameKey="CFUsername"
              UserEmailKey="CFUserEmail"
              ExternalLoginUrl="http://parentsite.com/login.aspx"
              ExternalRegistrationUrl=""
                />
```

Additional subdomain with HTTPS \(SSL\) steps

Let's assume your parent site is *parentsite.com* and the subdomain is *sub.parentsite.com.* Below are the recommended settings.

**parentsite.com web.config**

```
    <authentication mode="Forms">
        <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" requireSSL="true" />
    </authentication>
```

**sub.parentsite.com web.config**

```
<authentication mode="Forms">
        <forms loginUrl="login" 
               name=".subASPXAuth" 
               domain="sub.parentsite.com" requireSSL="true"/>
    </authentication>
```

**SSO cookie creation code**

```
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" };
string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername"));
string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail"));
string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username));
string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt(userEmail));

var ssoCookie = new HttpCookie("CommunifireUserCookie");
ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
ssoCookie.Domain = ".parentsite.com";
ssoCookie.Expires = DateTime.Now.AddMonths(1);
ssoCookie.Secure = true;
HttpContext.Current.Response.Cookies.Add(ssoCookie);
```

The SSO cookie creation code should be placed after the user clicks the login button after entering correct credentials.

*username* and *userEmail* are the values for the person the SSO cookie is being created for. *username* must match that person's username or email address in Axero. *userEmail* must match their email address in Axero exactly, including capitalization; if it does not match, Axero ignores the cookie and the person stays signed out. If you want to create a non-persistent SSO cookie, you must remove *ssoCookie.Expires = DateTime.Now.AddMonths\(1\);* in the code above.

You should add all Communifire.\*.dll files to the *bin* directory of your parent site.

**CFSSOSettings.config**

```
<?xml version="1.0"?>
<SingleSignOn Enabled="true"
              CookieName="CommunifireUserCookie"
              CookieDomain=".parentsite.com"
              CookiePath="/"
              EncryptedCookie="true"
              EncryptionAlgorithm="AES"
              InitVectorAES=""
              EncryptionAlgorithmKey="externalcookie"
              EncryptionOption="All"
              UsernameKey="CFUsername"
              UserEmailKey="CFUserEmail"
              ExternalLoginUrl="https://parentsite.com/login.aspx"
              ExternalRegistrationUrl=""
                />
```

Additional subdirectory with HTTPS \(SSL\) steps

Let's assume your parent site is *parentsite.com* and the subdirectory is *parentsite.com/community.* Below are the recommended settings.

**parentsite.com web.config**

```
    <authentication mode="Forms">
        <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" requireSSL="true" />
    </authentication>
```

**SSO cookie creation code**

```
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" };
string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername"));
string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail"));
string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username));
string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt(userEmail));

var ssoCookie = new HttpCookie("CommunifireUserCookie");
ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName);
ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail);
ssoCookie.Domain = ".parentsite.com";
ssoCookie.Expires = DateTime.Now.AddMonths(1);
ssoCookie.Secure = true;
HttpContext.Current.Response.Cookies.Add(ssoCookie);
```

The SSO cookie creation code should be placed after the user hits the login button after entering correct credentials.

*username* and *userEmail* are the values for the person the SSO cookie is being created for. *username* must match that person's username or email address in Axero. *userEmail* must match their email address in Axero exactly, including capitalization; if it does not match, Axero ignores the cookie and the person stays signed out. If you want to create a non-persistent SSO cookie, you must remove *ssoCookie.Expires = DateTime.Now.AddMonths\(1\);* in the code above.

You should add all Communifire.\*.dll files to the *bin* directory of your parent site.

**parentsite.com/community web.config**

```
<authentication mode="Forms">
        <forms loginUrl="login" 
               name=".subASPXAuth" 
               domain="parentsite.com" path="/community" requireSSL="true"/>
    </authentication>
```

**CFSSOSettings.config**

```
<?xml version="1.0"?>
<SingleSignOn Enabled="true"
              CookieName="CommunifireUserCookie"
              CookieDomain=".parentsite.com"
              CookiePath="/"
              EncryptedCookie="true"
              EncryptionAlgorithm="AES"
              InitVectorAES=""
              EncryptionAlgorithmKey="externalcookie"
              EncryptionOption="All"
              UsernameKey="CFUsername"
              UserEmailKey="CFUserEmail"
              ExternalLoginUrl="https://parentsite.com/login.aspx"
              ExternalRegistrationUrl=""
                />
```

Custom SSO Cookie Encryption

If you cannot reference *Communifire.BL.dll*, you can use the code below to encrypt SSO cookies. If you are creating SSO cookies on non-.NET platforms \(such as JAVA, PHP, etc.\), then you can create a web service wrapper around the .NET encryption method.

```
#region Using Directives

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

#endregion

namespace Communifire.Common
{
/// <summary>
/// Class for Security.
/// </summary>
public class Security
{
/// <summary>
/// Initializes a new instance of the <see cref="Security"/> class.
/// </summary>
public Security()
{
//
// TODO: Add constructor logic here
//
}

private string passPhrase = "hey1ie4o4"; // can be any string
private string saltValue = "8172hey87"; // can be any string
private string hashAlgorithm = "SHA1"; // can be "MD5"SHA1
private int passwordIterations = 2; // can be any number
private string initVector = "@1B2c3D4e5F6g7H8"; // must be 16 bytes
private int keySize = 128; // can be 192 or 128 or 256

public string PassPhrase
{
get { return passPhrase; }
set { passPhrase = value; }
}

public string InitVector
{
get { return initVector; }
set { initVector = value; }
}

public string HashAlgorithm
{
get { return hashAlgorithm; }
set { hashAlgorithm = value; }
}

/// <summary>
/// Encrypts specified plaintext using Rijndael symmetric key algorithm
/// and returns a base64-encoded result.
/// </summary>
/// <param name="plainText">
/// Plaintext value to be encrypted.
/// </param>
/// <param name="passPhrase">
/// Passphrase from which a pseudo-random password will be derived. The
/// derived password will be used to generate the encryption key.
/// Passphrase can be any string. In this example we assume that this
/// passphrase is an ASCII string.
/// </param>
/// <param name="saltValue">
/// Salt value used along with passphrase to generate password. Salt can
/// be any string. In this example we assume that salt is an ASCII string.
/// </param>
/// <param name="hashAlgorithm">
/// Hash algorithm used to generate password. Allowed values are: "MD5" and
/// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes.
/// </param>
/// <param name="passwordIterations">
/// Number of iterations used to generate password. One or two iterations
/// should be enough.
/// </param>
/// <param name="initVector">
/// Initialization vector (or IV). This value is required to encrypt the
/// first block of plaintext data. For RijndaelManaged class IV must be 
/// exactly 16 ASCII characters long.
/// </param>
/// <param name="keySize">
/// Size of encryption key in bits. Allowed values are: 128, 192, and 256. 
/// Longer keys are more secure than shorter keys.
/// </param>
/// <returns>
/// Encrypted value formatted as a base64-encoded string.
/// </returns>
public string Encrypt(string plainText)
{

// Convert strings into byte arrays.
// Let us assume that strings only contain ASCII codes.
// If strings include Unicode characters, use Unicode, UTF7, or UTF8 
// encoding.
byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);

// Convert our plaintext into a byte array.
// Let us assume that plaintext contains UTF8-encoded characters.
byte[] plainTextBytes = Encoding.UTF8.GetBytes(plainText);

// First, we must create a password, from which the key will be derived.
// This password will be generated from the specified passphrase and 
// salt value. The password will be created using the specified hash 
// algorithm. Password creation can be done in several iterations.
PasswordDeriveBytes password = new PasswordDeriveBytes(
passPhrase,
saltValueBytes,
hashAlgorithm,
passwordIterations);

// Use the password to generate pseudo-random bytes for the encryption
// key. Specify the size of the key in bytes (instead of bits).
byte[] keyBytes = password.GetBytes(keySize / 8);

// Create uninitialized Rijndael encryption object.
RijndaelManaged symmetricKey = new RijndaelManaged();

// It is reasonable to set encryption mode to Cipher Block Chaining
// (CBC). Use default options for other symmetric key parameters.
symmetricKey.Mode = CipherMode.CBC;

// Generate encryptor from the existing key bytes and initialization 
// vector. Key size will be defined based on the number of the key 
// bytes.
ICryptoTransform encryptor = symmetricKey.CreateEncryptor(
keyBytes,
initVectorBytes);

// Define memory stream which will be used to hold encrypted data.
MemoryStream memoryStream = new MemoryStream();

// Define cryptographic stream (always use Write mode for encryption).
CryptoStream cryptoStream = new CryptoStream(memoryStream,
encryptor,
CryptoStreamMode.Write);
// Start encrypting.
cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);

// Finish encrypting.
cryptoStream.FlushFinalBlock();

// Convert our encrypted data from a memory stream into a byte array.
byte[] cipherTextBytes = memoryStream.ToArray();

// Close both streams.
memoryStream.Close();
cryptoStream.Close();

// Convert encrypted data into a base64-encoded string.
string cipherText = Convert.ToBase64String(cipherTextBytes);

// Return encrypted string.
return cipherText;
}

/// <summary>
/// Decrypts specified ciphertext using Rijndael symmetric key algorithm.
/// </summary>
/// <param name="cipherText">
/// Base64-formatted ciphertext value.
/// </param>
/// <param name="passPhrase">
/// Passphrase from which a pseudo-random password will be derived. The
/// derived password will be used to generate the encryption key.
/// Passphrase can be any string. In this example we assume that this
/// passphrase is an ASCII string.
/// </param>
/// <param name="saltValue">
/// Salt value used along with passphrase to generate password. Salt can
/// be any string. In this example we assume that salt is an ASCII string.
/// </param>
/// <param name="hashAlgorithm">
/// Hash algorithm used to generate password. Allowed values are: "MD5" and
/// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes.
/// </param>
/// <param name="passwordIterations">
/// Number of iterations used to generate password. One or two iterations
/// should be enough.
/// </param>
/// <param name="initVector">
/// Initialization vector (or IV). This value is required to encrypt the
/// first block of plaintext data. For RijndaelManaged class IV must be
/// exactly 16 ASCII characters long.
/// </param>
/// <param name="keySize">
/// Size of encryption key in bits. Allowed values are: 128, 192, and 256.
/// Longer keys are more secure than shorter keys.
/// </param>
/// <returns>
/// Decrypted string value.
/// </returns>
/// <REMARKS>
/// Most of the logic in this function is similar to the Encrypt
/// logic. In order for decryption to work, all parameters of this function
/// - except cipherText value - must match the corresponding parameters of
/// the Encrypt function which was called to generate the
/// ciphertext.
/// </REMARKS>
public string Decrypt(string cipherText)
{
string plainText = string.Empty;
if (!string.IsNullOrEmpty(cipherText))
{
cipherText = cipherText.Replace(" ", "+");
// Convert strings defining encryption key characteristics into byte
// arrays. Let us assume that strings only contain ASCII codes.
// If strings include Unicode characters, use Unicode, UTF7, or UTF8
// encoding.
byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);

// Convert our ciphertext into a byte array.
byte[] cipherTextBytes = Convert.FromBase64String(cipherText);

// First, we must create a password, from which the key will be 
// derived. This password will be generated from the specified 
// passphrase and salt value. The password will be created using
// the specified hash algorithm. Password creation can be done in
// several iterations.
PasswordDeriveBytes password = new PasswordDeriveBytes(
passPhrase,
saltValueBytes,
hashAlgorithm,
passwordIterations);

// Use the password to generate pseudo-random bytes for the encryption
// key. Specify the size of the key in bytes (instead of bits).
byte[] keyBytes = password.GetBytes(keySize/8);

// Create uninitialized Rijndael encryption object.
RijndaelManaged symmetricKey = new RijndaelManaged();

// It is reasonable to set encryption mode to Cipher Block Chaining
// (CBC). Use default options for other symmetric key parameters.
symmetricKey.Mode = CipherMode.CBC;

// Generate decryptor from the existing key bytes and initialization 
// vector. Key size will be defined based on the number of the key 
// bytes.
ICryptoTransform decryptor = symmetricKey.CreateDecryptor(
keyBytes,
initVectorBytes);

// Define memory stream which will be used to hold encrypted data.
MemoryStream memoryStream = new MemoryStream(cipherTextBytes);

// Define cryptographic stream (always use Read mode for encryption).
CryptoStream cryptoStream = new CryptoStream(memoryStream,
decryptor,
CryptoStreamMode.Read);

// Since at this point we don't know what the size of decrypted data
// will be, allocate the buffer long enough to hold ciphertext;
// plaintext is never longer than ciphertext.
byte[] plainTextBytes = new byte[cipherTextBytes.Length];

// Start decrypting.
int decryptedByteCount = cryptoStream.Read(plainTextBytes,
0,
plainTextBytes.Length);

// Close both streams.
memoryStream.Close();
cryptoStream.Close();

// Convert decrypted data into a string. 
// Let us assume that the original plaintext string was UTF8-encoded.
plainText = Encoding.UTF8.GetString(plainTextBytes,
0,
decryptedByteCount);
}
// Return decrypted string. 
return plainText;
}

}
}
```