PIEE (Procurement Integrated Enterprise Environment) Generic Single Sign On (SSO) D Guidance 26-Jun: Would like to see a refresh of this title slide. Should be able to see representation of all services and civilians (i.e. humanitarian effort). Director would like for us to bring him a few recommendations of possible design refreshes.

SSO Solution OAuth (Open Authentication) OAuth is an open standard for authentication. OAuth allows users to hand out tokens instead of credentials to their data hosted by a given service provider. Each token grants access to a specific site (e.g. Wide Area Workflow e-Business Suite) for specific resources (e.g. user’s first name, last name) and for a defined duration (e.g. the next 5 minutes). OpenID Connect OpenID Connect is used in conjunction with OAuth 2.0 to allow registered SSO client applications access to user information from PIEE Applications. OpenID requests must first be authorized by OAuth 2.0. User Info can include: User ID, First Name, Last Name, Enabled Flag, DOD ID, Email Address, Title, and Organization. For more information about OpenID Connect, please visit http://openid.net/connect/ For more information about OAuth, please visit http://oauth.net/documentation/getting-started/

SSO Overview Trusted System SSO Client Application in PIEE Account Registration, Approval, and Single Sign On SSO Client Application in PIEE OAuth to authorize user, then OpenID to retrieve info.

SSO Sequence Diagram User’s Browser Trusted System Target PIEE Application User Accesses the Trusted System Log onto Trusted System Create Session User Clicks on the SSO Client Application Sends request to specified URL provided by client application User Requests access to the SSO Client User’s Browser Receives URL Build OAuth authorization URL to User Send OAuth HTTP(S) redirect URL to user’s browser Format of the URL request: <Trustedsys Sever URL>/portal/oauth2/authorize?response_type=code &client_id=<Provided client ID>&redirect_uri=<Client provided redirect URI> Browser Redirects to provided URL Validate provided Client ID Redirect to Trusted Sys Browse Receive Redirect From Trusted System Redirect to browser Create Authorization Code

SSO Sequence Diagram User’s Browser Trusted System Target PIEE Application Browser redirects back to SSO client Browser redirects to provided redirect URI in step 3 Receive authorization code Format of the URL response: <Client redirect URI>?code=<Trust generated authorization code> Validate POST Request received Send POST Request to Trust Sys Build OAuth authorization request to Trusted System POST Request must include a HTTP Authorization of base 64 encoded client ID and password provided to SSO client application (example: Authorization: Basic ZGFpY2xpZW50OIFhendzeEAx) POST Request URL format: <Trust Server URL>/portal/oauth2/ token?grant_type=authorization_code& code=<Authorization Code Provided>&redirect_uri=<Client redirect URI> Authorization JSON Data Format: { “user_id”:”<userId>”, “expires_in”:”300”, (seconds until access token expires) “refresh_token”:”<refresh token>” “access_token”:”<access token>” (token used to retrieve user information) } Create Authorization token JSON data Send POST Response to client Receive JSON Authorization token data

SSO Sequence Diagram User’s Browser Trusted Systems Target PIEE Application User JSON Data Format can include: {    “userId":“<userId>",    "roles":[       { <role particular information>       }    ],    “dodId":“<EDPI Number>",    "title":“<user’s title>",    "organization":”<user’s organization>”,    "firstName":“<first name>",    "lastName":“<last name>",    "enabled":true,    "email":“<email address>",    "phoneNumber":“<phone number>",    "dsnPhoneNumber":”<DSN phone>” } Note: this can change based on the SSO Client’s needs Validate the access token received Send Get Request to Trusted Sys Build request for user data (per OpenID Connect) Get Request URL format: <Trust Server URL>/userdata/ <provided user ID>?oauth_token= <provided access token> Build JSON response of User’s Data Send response to client Receive requested User JSON data

SSO More Information For more information on interfacing with PIEE system SSO, you may view the document linked below for sample requests and detailed steps.

Questions/Comments???