Communifire supports single-sign on (SSO) for any custom SSO provider. Your existing website can be in any technology (PHP, Java, or ASP.NET) as long as it can create and support cookies. Note that your point of registration (new user creation) would be your existing application. You can use the Communifire REST API to make sure that your new users are also saved in the Communifire database (so that it is in sync with your existing application's database).
Assumptions:
Client-side setup is estimated to take 1-3 hours and Axero team setup is estimated to take 2-3 hours. The time to set up SSO can vary based on how long it takes to set up internal systems and to provide the Axero team with required information. The total time for setting up SSO may take up to 1-2 business days.
<SingleSignOn Enabled="true" CookieName="CommunifireUserCookie" CookieDomain=".existing-website.com" CookiePath="YOUR-SITE-PATH" EncryptedCookie="true" EncryptionAlgorithm="AES" InitVectorAES="" EncryptionAlgorithmKey="" EncryptionOption="ValuesOnly" UsernameKey="CFUsername" UserEmailKey="CFUserEmail" ExternalLoginUrl="http://www.existing-website.com/login.asp" ExternalRegistrationUrl="http://www.existing-website.com/register.asp" />
cookie.Domain = ".existing-website.com";
Cookie Fix Required for IE8
IE8 needs the domain attribute to be set for the FormsAuthentication cookie in the Communifire web.config file. Edit web.config and set domain as follows:
<authentication mode="Forms"> <forms loginUrl="login.aspx" domain=".existing-website.com" path="/" /> </authentication>
This fix is needed only for IE8 as other browsers are able to handle the domain issue automatically.
//Create encrypted cookie Communifire.Common.Security sc = new Security(); sc.PassPhrase = "externalcookie"; string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername")); string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail")); string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt("USER_NAME_GOES_HERE")); string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt("USER_EMAIL_GOES_HERE")); HttpCookie cfCookie = new HttpCookie("CommunifireUserCookie"); cfCookie.Values.Add(encryptedUserNameKey, encryptedUserName); cfCookie.Values.Add(encryptedEmailKey, encryptedUserEmail); cfCookie.Expires = DateTime.UtcNow.AddDays(30); cfCookie.Domain = ".your-exisiting-domain.com"; HttpContext.Current.Response.Cookies.Add(cfCookie);
<SingleSignOn> section in CFSSOSettings.config
<SingleSignOn Enabled="true" CookieName="CommunifireUserCookie" CookieDomain=".your-exisiting-domain.com" CookiePath="/site" EncryptedCookie="true" EncryptionAlgorithm="AES" InitVectorAES="" EncryptionAlgorithmKey="externalcookie" EncryptionOption="All" UsernameKey="CFUsername" UserEmailKey="CFUserEmail" ExternalLoginUrl="http://your-existing-website.com/login.asp" ExternalRegistrationUrl="http://your-existing-website.com/register.asp" />
Note: If you cannot access Communifire.Common.DLL, please check the end of this page to see the instructions for using your own encryption method.
You can specify the page the user is redirected to after logging in by setting General Settings > Site Settings > Post login landing page.
SSO Timeout Issue in a Web Farm Configuration
If you encounter the following error in the event log, it means that the forms authentication ticket is not matching the generated original value, a situation which may arise on a web farm deployment.
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
The application uses the machinekey definition to generate the authentication cookie. If machinekey properties are not initialized in the web.config file, the application uses different values on the different servers. So for instance, if you have been logged in on server X and then try to log in on server Y, the application may use the cookie from server X, which is different from the cookie that server Y uses. Thus, you cannot log in.
machinekey properties must be always defined for applications that are moved from server to server.
This issue can often be caused by having auto-generated <machineKey /> keys in your server's machine.config file. Each time your application starts afresh, it will generate new keys. This invalidates any existing encrypted viewstate or forms authentication tickets.
<machineKey />
Try setting the <machineKey /> validationKey and decryptionKey to fixed values. See the following link for more information: How To: Configure MachineKey in ASP.NET 2.0 (MSDN).
validationKey
decryptionKey
If you are working with HTTPS (SSL), add requireSSL="true" to the authentication tag in web.config.
<authentication mode="Forms"> <forms loginUrl="login.aspx" requireSSL="true" /> </authentication>
Host file (%WINDIR%\System32\drivers\etc\hosts) code
# Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. 127.0.0.1 localhost cftesting.com
In IIS:
Make the following virtual directories under the default application (e.g. http://cftesting.com/):
The Communifire site contains the Communfire application code. ExternalLoginSite is the site where your external login page resides. The user will enter their credentials at the external site and then be redirected to the Communifire site.
Communifire site's CFSSOSettings.config code
<?xml version="1.0"?> <SingleSignOn Enabled="true" CookieName="CommunifireUserCookie" CookieDomain=".cftesting.com" CookiePath="/" EncryptedCookie="true" EncryptionAlgorithm="AES" InitVectorAES="" EncryptionAlgorithmKey="externalcookie" EncryptionOption="All" UsernameKey="CFUsername" UserEmailKey="CFUserEmail" ExternalLoginUrl="http://cftesting.com/ExternalLoginSite/login.aspx" ExternalRegistrationUrl="" />
ExternalLoginSite's login.aspx code
<%@ Page Language="C#" AutoEventWireup="true" %> <%@ Import Namespace="Communifire.Common" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head runat="server"> <title></title> </head> <body> <form id="form1" runat="server"> <asp:Login ID="Login1" runat="server" OnAuthenticate="Login1_Authenticate"> </asp:Login> </form> </body> </html> <script runat="server" language="C#"> protected void Login1_Authenticate(object sender, AuthenticateEventArgs e) { Communifire.Common.Security sc = new Security(); sc.PassPhrase = "externalcookie"; string encryptedUserNameKey = Server.UrlEncode(sc.Encrypt("CFUsername")); string encryptedEmailKey = Server.UrlEncode(sc.Encrypt("CFUserEmail")); string encryptedUserName = Server.UrlEncode(sc.Encrypt(Login1.UserName)); string encryptedUserEmail = Server.UrlEncode(sc.Encrypt("admin@admin.com")); HttpCookie fakeCookie = new HttpCookie("CommunifireUserCookie"); fakeCookie.Values.Add(encryptedUserNameKey, encryptedUserName); fakeCookie.Values.Add(encryptedEmailKey, encryptedUserEmail); fakeCookie.Path = "/"; fakeCookie.Domain = ".cftesting.com"; HttpContext.Current.Response.Cookies.Add(fakeCookie); FormsAuthentication.SetAuthCookie(encryptedUserNameKey, false); Response.Redirect(Request.QueryString["ReturnUrl"]); } </script>
The video below shows how SSO works on the user's side. (Click to open it a new window.)
Let's assume your parent site is parentsite.com and the subdomain is sub.parentsite.com. Below are the recommended settings.
parentsite.com web.config
<authentication mode="Forms"> <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" /> </authentication>
sub.parentsite.com web.config
<authentication mode="Forms"> <forms loginUrl="login.aspx" name=".subASPXAuth" domain="sub.parentsite.com" /> </authentication>
SSO cookie creation code
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" }; string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername")); string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail")); string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username)); string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt("admin@admin.com")); var ssoCookie = new HttpCookie("CommunifireUserCookie"); ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName); ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail); ssoCookie.Domain = ".parentsite.com"; ssoCookie.Expires = DateTime.Now.AddMonths(1); HttpContext.Current.Response.Cookies.Add(ssoCookie);
The SSO cookie creation code should be placed after the user clicks the login button after entering correct credentials.
Username is the username of the user for whom the SSO cookie is being created. This username must match the user's username in Communifire. If you want to create a non-persistent SSO cookie, you must remove ssoCookie.Expires = DateTime.Now.AddMonths(1); in the code above.
You should add all Communifire.*.dll files to the bin directory of your parent site.
CFSSOSettings.config
<?xml version="1.0"?> <SingleSignOn Enabled="true" CookieName="CommunifireUserCookie" CookieDomain=".parentsite.com" CookiePath="/" EncryptedCookie="true" EncryptionAlgorithm="AES" InitVectorAES="" EncryptionAlgorithmKey="externalcookie" EncryptionOption="All" UsernameKey="CFUsername" UserEmailKey="CFUserEmail" ExternalLoginUrl="http://parentsite.com/login.aspx" ExternalRegistrationUrl="" />
Let's assume your parent site is parentsite.com and the subdirectory is parentsite.com/community. Below are the recommended settings.
parentsite.com/community web.config
<authentication mode="Forms"> <forms loginUrl="login.aspx" name=".subASPXAuth" domain="parentsite.com" path="/community"/> </authentication>
<authentication mode="Forms"> <forms loginUrl="login.aspx" domain="parentsite.com" enableCrossAppRedirects="true" requireSSL="true" /> </authentication>
<authentication mode="Forms"> <forms loginUrl="login.aspx" name=".subASPXAuth" domain="sub.parentsite.com" requireSSL="true"/> </authentication>
var sc = new Communifire.Common.Security { PassPhrase = "externalcookie" }; string encryptedUserNameKey = HttpUtility.UrlEncode(sc.Encrypt("CFUsername")); string encryptedEmailKey = HttpUtility.UrlEncode(sc.Encrypt("CFUserEmail")); string encryptedUserName = HttpUtility.UrlEncode(sc.Encrypt(username)); string encryptedUserEmail = HttpUtility.UrlEncode(sc.Encrypt("admin@admin.com")); var ssoCookie = new HttpCookie("CommunifireUserCookie"); ssoCookie.Values.Add(encryptedUserNameKey, encryptedUserName); ssoCookie.Values.Add(encryptedEmailKey, encryptedUserEmail); ssoCookie.Domain = ".parentsite.com"; ssoCookie.Expires = DateTime.Now.AddMonths(1); ssoCookie.Secure = true; HttpContext.Current.Response.Cookies.Add(ssoCookie);
<?xml version="1.0"?> <SingleSignOn Enabled="true" CookieName="CommunifireUserCookie" CookieDomain=".parentsite.com" CookiePath="/" EncryptedCookie="true" EncryptionAlgorithm="AES" InitVectorAES="" EncryptionAlgorithmKey="externalcookie" EncryptionOption="All" UsernameKey="CFUsername" UserEmailKey="CFUserEmail" ExternalLoginUrl="https://parentsite.com/login.aspx" ExternalRegistrationUrl="" />
The SSO cookie creation code should be placed after the user hits the login button after entering correct credentials.
<authentication mode="Forms"> <forms loginUrl="login.aspx" name=".subASPXAuth" domain="parentsite.com" path="/community" requireSSL="true"/> </authentication>
If you do not have access to or cannot use Communifire.Common DLL, you can use the code below to encrypt SSO cookies. If you are creating SSO cookies on non-.NET platforms (such as JAVA, PHP, etc.), then you can create a web service wrapper around the .NET encryption method.
#region Using Directives using System; using System.IO; using System.Security.Cryptography; using System.Text; #endregion namespace Communifire.Common { /// <summary> /// Class for Security. /// </summary> public class Security { /// <summary> /// Initializes a new instance of the <see cref="Security"/> class. /// </summary> public Security() { // // TODO: Add constructor logic here // } private string passPhrase = "hey1ie4o4"; // can be any string private string saltValue = "8172hey87"; // can be any string private string hashAlgorithm = "SHA1"; // can be "MD5"SHA1 private int passwordIterations = 2; // can be any number private string initVector = "@1B2c3D4e5F6g7H8"; // must be 16 bytes private int keySize = 128; // can be 192 or 128 or 256 public string PassPhrase { get { return passPhrase; } set { passPhrase = value; } } public string InitVector { get { return initVector; } set { initVector = value; } } public string HashAlgorithm { get { return hashAlgorithm; } set { hashAlgorithm = value; } } /// <summary> /// Encrypts specified plaintext using Rijndael symmetric key algorithm /// and returns a base64-encoded result. /// </summary> /// <param name="plainText"> /// Plaintext value to be encrypted. /// </param> /// <param name="passPhrase"> /// Passphrase from which a pseudo-random password will be derived. The /// derived password will be used to generate the encryption key. /// Passphrase can be any string. In this example we assume that this /// passphrase is an ASCII string. /// </param> /// <param name="saltValue"> /// Salt value used along with passphrase to generate password. Salt can /// be any string. In this example we assume that salt is an ASCII string. /// </param> /// <param name="hashAlgorithm"> /// Hash algorithm used to generate password. Allowed values are: "MD5" and /// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes. /// </param> /// <param name="passwordIterations"> /// Number of iterations used to generate password. One or two iterations /// should be enough. /// </param> /// <param name="initVector"> /// Initialization vector (or IV). This value is required to encrypt the /// first block of plaintext data. For RijndaelManaged class IV must be /// exactly 16 ASCII characters long. /// </param> /// <param name="keySize"> /// Size of encryption key in bits. Allowed values are: 128, 192, and 256. /// Longer keys are more secure than shorter keys. /// </param> /// <returns> /// Encrypted value formatted as a base64-encoded string. /// </returns> public string Encrypt(string plainText) { // Convert strings into byte arrays. // Let us assume that strings only contain ASCII codes. // If strings include Unicode characters, use Unicode, UTF7, or UTF8 // encoding. byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector); byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue); // Convert our plaintext into a byte array. // Let us assume that plaintext contains UTF8-encoded characters. byte[] plainTextBytes = Encoding.UTF8.GetBytes(plainText); // First, we must create a password, from which the key will be derived. // This password will be generated from the specified passphrase and // salt value. The password will be created using the specified hash // algorithm. Password creation can be done in several iterations. PasswordDeriveBytes password = new PasswordDeriveBytes( passPhrase, saltValueBytes, hashAlgorithm, passwordIterations); // Use the password to generate pseudo-random bytes for the encryption // key. Specify the size of the key in bytes (instead of bits). byte[] keyBytes = password.GetBytes(keySize / 8); // Create uninitialized Rijndael encryption object. RijndaelManaged symmetricKey = new RijndaelManaged(); // It is reasonable to set encryption mode to Cipher Block Chaining // (CBC). Use default options for other symmetric key parameters. symmetricKey.Mode = CipherMode.CBC; // Generate encryptor from the existing key bytes and initialization // vector. Key size will be defined based on the number of the key // bytes. ICryptoTransform encryptor = symmetricKey.CreateEncryptor( keyBytes, initVectorBytes); // Define memory stream which will be used to hold encrypted data. MemoryStream memoryStream = new MemoryStream(); // Define cryptographic stream (always use Write mode for encryption). CryptoStream cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write); // Start encrypting. cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length); // Finish encrypting. cryptoStream.FlushFinalBlock(); // Convert our encrypted data from a memory stream into a byte array. byte[] cipherTextBytes = memoryStream.ToArray(); // Close both streams. memoryStream.Close(); cryptoStream.Close(); // Convert encrypted data into a base64-encoded string. string cipherText = Convert.ToBase64String(cipherTextBytes); // Return encrypted string. return cipherText; } /// <summary> /// Decrypts specified ciphertext using Rijndael symmetric key algorithm. /// </summary> /// <param name="cipherText"> /// Base64-formatted ciphertext value. /// </param> /// <param name="passPhrase"> /// Passphrase from which a pseudo-random password will be derived. The /// derived password will be used to generate the encryption key. /// Passphrase can be any string. In this example we assume that this /// passphrase is an ASCII string. /// </param> /// <param name="saltValue"> /// Salt value used along with passphrase to generate password. Salt can /// be any string. In this example we assume that salt is an ASCII string. /// </param> /// <param name="hashAlgorithm"> /// Hash algorithm used to generate password. Allowed values are: "MD5" and /// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes. /// </param> /// <param name="passwordIterations"> /// Number of iterations used to generate password. One or two iterations /// should be enough. /// </param> /// <param name="initVector"> /// Initialization vector (or IV). This value is required to encrypt the /// first block of plaintext data. For RijndaelManaged class IV must be /// exactly 16 ASCII characters long. /// </param> /// <param name="keySize"> /// Size of encryption key in bits. Allowed values are: 128, 192, and 256. /// Longer keys are more secure than shorter keys. /// </param> /// <returns> /// Decrypted string value. /// </returns> /// <REMARKS> /// Most of the logic in this function is similar to the Encrypt /// logic. In order for decryption to work, all parameters of this function /// - except cipherText value - must match the corresponding parameters of /// the Encrypt function which was called to generate the /// ciphertext. /// </REMARKS> public string Decrypt(string cipherText) { string plainText = string.Empty; if (!string.IsNullOrEmpty(cipherText)) { cipherText = cipherText.Replace(" ", "+"); // Convert strings defining encryption key characteristics into byte // arrays. Let us assume that strings only contain ASCII codes. // If strings include Unicode characters, use Unicode, UTF7, or UTF8 // encoding. byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector); byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue); // Convert our ciphertext into a byte array. byte[] cipherTextBytes = Convert.FromBase64String(cipherText); // First, we must create a password, from which the key will be // derived. This password will be generated from the specified // passphrase and salt value. The password will be created using // the specified hash algorithm. Password creation can be done in // several iterations. PasswordDeriveBytes password = new PasswordDeriveBytes( passPhrase, saltValueBytes, hashAlgorithm, passwordIterations); // Use the password to generate pseudo-random bytes for the encryption // key. Specify the size of the key in bytes (instead of bits). byte[] keyBytes = password.GetBytes(keySize/8); // Create uninitialized Rijndael encryption object. RijndaelManaged symmetricKey = new RijndaelManaged(); // It is reasonable to set encryption mode to Cipher Block Chaining // (CBC). Use default options for other symmetric key parameters. symmetricKey.Mode = CipherMode.CBC; // Generate decryptor from the existing key bytes and initialization // vector. Key size will be defined based on the number of the key // bytes. ICryptoTransform decryptor = symmetricKey.CreateDecryptor( keyBytes, initVectorBytes); // Define memory stream which will be used to hold encrypted data. MemoryStream memoryStream = new MemoryStream(cipherTextBytes); // Define cryptographic stream (always use Read mode for encryption). CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read); // Since at this point we don't know what the size of decrypted data // will be, allocate the buffer long enough to hold ciphertext; // plaintext is never longer than ciphertext. byte[] plainTextBytes = new byte[cipherTextBytes.Length]; // Start decrypting. int decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length); // Close both streams. memoryStream.Close(); cryptoStream.Close(); // Convert decrypted data into a string. // Let us assume that the original plaintext string was UTF8-encoded. plainText = Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount); } // Return decrypted string. return plainText; } } }
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/communifire-documentation/wiki/view/22926/custom-sso-integration
Your session has expired. You are being logged out.