Does single-sign-on mechanism allows a user to log into a web application and then access, say a mobile app without logging in again? - Progress Community

Loading

Skip to Main Content

Does single-sign-on mechanism allows a user to log into a web application and then access, say a mobile app without logging in again?

This article discusses the scope of the sealed security token called the ClientPrincipal that represents a user identity within a security domain, when used to authenticate a user in a WebApplication

Feb 15, 2017
Knowledge

Title

Does single-sign-on mechanism allows a user to log into a web application and then access, say a mobile app without logging in again?

URL Name

does-single-sign-on-mechanism-allows-a-user-to-log-into-a-web-application-and-then-access-say-a-mobile-app-without-logging-in-again

Article Number

000180874

Environment

Product: OpenEdge Version: 11.5 and later OS: All Supported Platforms

Question/Problem Description

Does the SSO allow a user to log into a web application and then access, say a mobile app without logging in again?

What is th scope of the sealed security token called the ClientPrincipal that represents a user identity within a security domain, when used to authenticate a user in a WebApplication?

Steps to Reproduce

Clarifying Information

Single-Sign-On is enabled on Progress Pacific AppServer (PASOE)

Error Message

Defect Number

Enhancement Number

Cause

Resolution

When a client successfully authenticates, a ClientPrincipal instance is created on the server and a security token representing the ClientPrincipal instance is returned to the client.

Each time the client makes a request it needs to identify itself to the server by sending this token in the URL:

- JSESSIONID query parameter (See note 3 of "Web application security configurations : Single sign-on (SSO) support in PAS for OpenEdge : Configuring the ClientPrincipal)

Or in the HTTP header:

- Cookie

Therefore the security token is retricted to the client. So, unless the same security token is shared between the client you access the web application from and the mobile app, you will have to log in separately on both clients.

The same applies if you have enabled SSO for 2 Web applications and access those 2 applications separately from 2 different browsers (For instance Firefox and Chrome).

Since the authentication token is not shared between both browsers, you will have to log in separately on each browser.

However, if you remain on the same browser to access both Web applications, you will have to log in only once, since the same security token will be used for both Web Apps.

Workaround

Notes

References to Other Documentation:

"Web Application Security Configurations : Single Sign-on (SSO) Support in PAS for OpenEdge." Pacific Application Server for OpenEdge: Administration Guide. OpenEdge 11.6 Documentation. Progress Software. Web. 15 Feb. 2017. <https://documentation.progress.com/output/ua/OpenEdge_latest/index.html#page/pasoe-admin/single-sign-on-(sso)-support-in-pas-for-openedge.html>.

Keyword Phrase

Last Modified Date

2/15/2017 1:32 PM

OpenEdge DeploymentOpenEdge ArchitectureOpenEdge DevelopmentOpenEdge General DiscussionsOpenEdge Pro2OpenEdge RDBMS

Drop Files

Upload FilesOr drop files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

Does single-sign-on mechanism allows a user to log into a web application and then access, say a mobile app without logging in again? - Progress Community