Scribd
Upload
22 views3 pages

EZone SSO

Uploaded by

upwork.khushboo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
22 views3 pages

EZone SSO

Uploaded by

upwork.khushboo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Exhibitor SSO

This document gives instructions on how to use the SSO into ASP’s
Exhibitor Zone from an external source. We follow the OAUTH 1.0a HMAC-
SHA1 signature to generate and validate a URL
ASSUMPTIONS

The following assumptions have been made in relation to the integration

▪ The exhibitor data has been uploaded to both ASP and the external system
▪ Each exhibitor contact has a unique identifier that is the same in both systems
▪ ASP has supplied the shared secret to create the signature

REQUEST METHOD & URL

HTTP Method: GET

Base URL

The base URL is the URL to which the request is directed, minus any query string or hash parameters. It is
important to use the correct protocol here, so make sure that the “https://” portion of the URL matches the
actual request sent to the API.

BaseURL: [SiteURL]/__zone/sso

[SiteURL] will be replaced with the actual URL of the website,


e.g https://www.example.com/__zone/sso

SSO PARAMETERS

You now need to gather all the parameters used in the request and to generate the signature. Below is a
list of parameters required.

Parameter Name Example Value Description

clientreference 123e4567-e89b- This is a pre-shared value that is unique to each exhibitor


12d3-a456- and has been uploaded to both platforms
426655440000

timestamp 1318622958 This is a UNIX timestamp. The link will expire 1 hour after
this time.

PRIVATE & CONFIDENTIAL PAGE 1 | 3


These values need to be encoded into a single string which will be used later on. The process to build
the string is very specific:

1. Percent encode every key and value that will be signed.


2. Sort the list of parameters alphabetically
3. For each key/value pair:
a. Append the encoded key to the output string.
b. Append the ‘=’ character to the output string.
c. Append the encoded value to the output string.
d. If there are more key/value pairs remaining, append a ‘&’ character to the output string.

The following example string should be created

clientreference=123e4567-e89b-12d3-a456-426655440000&timestamp=1318622958

CREATING THE SIGNATURE BASE STRING

The values collected so far need to be joined to make a single string from which we will generate the
signature. This is called the signature base string.

To encode the HTTP method, base URL, and SSO parameters into a single string:

▪ Convert the HTTP Method to uppercase and set the output string equal to this value.
▪ Append the ‘&’ character to the output string.
▪ Percent encode the URL and append it to the output string.
▪ Append the ‘&’ character to the output string.
▪ Percent encode the parameter string and append it to the output string.

This will produce a signature base string like the below

GET&https%3A%2F%2Ffanyv88.com%3A443%2Fhttp%2Fwww.example.com%2F__zone%2Fsso&clientreference%3D123e4567-e89b-
12d3-a456-426655440000%26timestamp%3D1318622958

Make sure to percent encode the parameter string! The signature base string should contain exactly 2
ampersand ‘&’ characters. Any percent ‘%’ characters in the parameter string should be encoded as %25
in the signature base string.

CALCULATING THE SIGNATURE

Finally, the signature is calculated by passing the signature base string and signing key to the HMAC-
SHA1 hashing algorithm. The details of the algorithm are explained in depth here, but thankfully there
are implementations of HMAC-SHA1 available for every popular language.

PRIVATE & CONFIDENTIAL PAGE 2 | 3


The output of the HMAC signing function is a binary string. This needs to be base64 encoded to produce
the signature string.

For example, the output given the base string and signing key given on this page is

92 3D 0B 33 7E 58 5F 59 9F 58 7C 2B 0F 60 AD 59 01 FF F0 64

That value, when converted to base64, is the OAuth signature for this request:

kj0LM35YX1mfWHwrD2CtWQH/8GQ=

Putting this all together creates a final SSO link of

https://www.example.com/__zone/sso?clientreference=123e4567-e89b-12d3-a456-
426655440000&timestamp=1318622958&signature=kj0LM35YX1mfWHwrD2CtWQH%2F8GQ%3D

PRIVATE & CONFIDENTIAL PAGE 3 | 3

You might also like