- Get Started
- Guides
- Integrations
- References
- API Reference
- Basic Payment
- Forex
- Authentication
- Card Account
- Apple Pay
- Virtual Account
- Bank Account
- Token Account
- Customer
- Billing Address
- Merchant Billing Address
- Shipping Address
- Merchant Shipping Address
- Corporate
- Sender
- Recipient
- Merchant
- Marketplace & Cart
- Airline
- Lodging
- Passenger
- Tokenization
- Recurring Migration
- 3D Secure
- Custom Parameters
- Async Payments
- Webhook notifications
- Job
- Risk
- Point of Sale
- Response Parameters
- Card On File
- Chargeback
- Result Codes
- Payment Methods
- Transaction Flows
- Regression Testing
- Data Retention Policy
- API Reference
- Support
Single Sign On Integration Guide
Last updated:October 03, 2024
Imagine a world where one set of credentials gives you access to multiple applications. That’s the convenience Single Sign-On (SSO) brings. It simplifies user experience, reduces password fatigue, and enhances security.
What makes OAuth OpenID Connect special?
OAuth OpenID Connect is the engine that powers SSO. It’s an authentication standard built on OAuth 2.0. Unlike SAML, which uses XML, OAuth OpenID Connect uses JSON. This makes it lightweight and perfect for the web. It verifies user identity and gathers basic profile information in a secure and efficient manner.
OAuth OpenID Connect is the engine that powers SSO. It’s an authentication standard built on OAuth 2.0. Unlike SAML, which uses XML, OAuth OpenID Connect uses JSON. This makes it lightweight and perfect for the web. It verifies user identity and gathers basic profile information in a secure and efficient manner.
Why are SSO and OAuth OpenID Connect the perfect pair?
When you log into one application using SSO with OAuth OpenID Connect, you’re authenticated across all connected applications. It’s seamless, efficient, and the future of authentication.
When you log into one application using SSO with OAuth OpenID Connect, you’re authenticated across all connected applications. It’s seamless, efficient, and the future of authentication.
Use cases
User login
Authenticate swiftly and securely with your trusted identity provider. Experience a seamless login process, bypassing the need to remember another set of credentials. Enjoy the enhanced security provided by your identity provider’s robust authentication measures. This is the convenience and security of Single Sign-On.
How it works
Application-Server Interaction
Acquire access token
Request an access token post successful authorization.
Application-Server Interaction
Retrieve user information
Use the access token to fetch user information and decide to grant the user access.
1. Initiate authorization
This step occurs in the user’s browser.
-
Initiate Authorization: Your application redirects the user’s browser to the identity provider’s
authorization endpoint (
/v2/authorize
). - User Login: The user enters their credentials and logs in on the identity provider’s page.
- Two-Factor Authentication (2FA): If enabled, the user completes the second factor (e.g., entering a code sent to their mobile device).
- Return to Application: Post successful login and 2FA verification, the user’s browser is redirected back to your application using the predefined redirect URL.
When integrating with our SSO application based on OpenID Connect, it is crucial to obtain explicit end-user consent
before including Personally Identifiable Information (PII) such as
name
and preferred_username
in the
/sso/v2/userinfo
response. This consent is automatically integrated during the authorization flow when
the scope=openid profile
is requested. External applications should ensure they comply with this process
to maintain user trust and data privacy.
Sample request:
2. Acquire access token
This step is handled by your application’s server.
- Acquire Access Token: Your application makes a request to the identity provider’s token endpoint (/v2/token) and receives an access token.
Sample request:
3. Retrieve user information
This step is also handled by your application’s server.
- Retrieve User Information: Your application uses the access token to query the identity provider’s user information endpoint (/v2/userinfo).
- User Login Confirmation: Based on the received information and your application’s rules, decide whether to grant the user access.
Sample request:
Session Tracker
Experience the power of real-time session tracking in Single Sign-On (SSO). Our session tracker keeps you informed about the user’s active status in the Authentication Manager and any logout actions from connected applications. Upon logout, your application receives an instant alert, enabling swift response. Post-action, your application is ready to initiate a new Login Workflow, ensuring a smooth transition for potential user re-login. Discover enhanced control and fluid user management with our session tracker in SSO.
Here’s the swift workflow:- User logs into your application via the Login Workflow.
- User navigates to a different application, like the Open Payment Platform.
- User logs out, activating the Logout workflow on the visited application.
- User accesses an internal page in your application. The Session Tracker JavaScript Snippet promptly alerts your application about the session change.
- Your application swiftly terminates the local user session and readies a new Login Workflow.
How it works
Verifying user login status (individual check)
Perform individual checks to see if the user has remotely logged out.
Verifying user login status (polling)
Continually verifies at set intervals if the user has logged out.
1. Responding to logout events
Your application can receive notifications about changes in the user’s remote session (on the Authentication Manager)
by embedding a JavaScript Snippet on each page of your application. This allows your application to take action, such as
terminating the local user session and initiating a new Login Workflow.
Please add the following JavaScript code to each page of your application that needs to respond to remote logout events:
2. Verifying user login status (individual check)
After integrating the above script into your page, your application can perform individual checks to see if the user has remotely logged out. If the remote login status of the user is not as expected (‘logged_in’), your application will be notified via the function defined by _OASM('on_change').
3. Verifying user login status (polling)
Your application can also set up a polling mechanism that continually verifies at set intervals if the user has logged out.
User logout
Authenticate swiftly and securely with your trusted identity provider. Experience a seamless login process, bypassing the need to remember another set of credentials. Enjoy the enhanced security provided by your identity provider’s robust authentication measures. This is the convenience and security of Single Sign-On.
How it works
1. Terminate session
Redirect the user to the identity provider’s page to initiate the authorization process.
Sample request: