App integration into AC via login

[matty]

I am creating a web based app that will allow our customers to log in hopefully via their AC credentials. Wondering if anyone has done this before and where to start?

Thanks!
Matt

[AbleMods]

Hi Matt,

Your question is pretty difficult to answer without greater detail.

If you're looking to implement SSO (Single Sign On) between two different .Net applications using pass-through authentication, that is certainly possible. The level of difficulty in configuring everything rests on whether the two apps are in the same domain or use separate domain names. There are several articles you can google on configuring SSO aka pass-through authentication. It's rarely a simple process, so plan on it taking a few tries to get it working properly. But it's certainly possible.

If you want to SYNC credentials between the two apps, that's going to take some programming work. If you are familiar with creating RESTful endpoints, the process is fairly painless.

Another decision is how the entry point to your custom web app will be made. Is it a direct url, or will users always have to enter Able first and then travel to the custom web app? This can also have a significant impact on how you design the security integration between the two apps.

[matty]

Joe,

Thanks for the reply.

I don't plan on implementing a pass-through auth for a variety of reasons.

The simple of it is that the application will only being using existing users passwords to authenticate, not new users. There will be no creation of accounts through this process. Creating an endpoint is straightforward, but the issue lies in the hash of the passwords in the user accounts. For that, my assumption is that the seeding, etc is all done through AC and I need to go through one of their auth methods to properly hash the provided password to compare in the DB. That's all.

The new app is pure .NET.

Let me know if this provides the details you were looking for and thanks again for the reply.

Matt

[AbleMods]

That helps greatly, thanks!

Yes, passwords are encrypted in Able data. And there is no way to de-crypt the password directly for obvious security reasons. What you'll need to do is design an endpoint in Able to receive the username/password from your new app. In the Able endpoint, you submit the username/password for validation. The result will be true/false which you can then pass as the response to the calling app.

Assuming this is Able Gold, the easiest route would be to first load the user by username and validate the username exists. Once you have the user object loaded, you can test any password:

Code: Select all

            User user = UserDataSource.LoadForUserName("doctor@foo.com");
            if (user != null)
            {
                return user.CheckPassword("abc123");
            }

[matty]

Joe,

This is perfect! Thank you.

Matt

[AbleMods]

No problem, glad to help.