Custom SSO Authentication in iHub 3.1

<p>Martin --</p>
<p>  I've attached a pretty vanilla example of how you can authenticate a user with IPSE and OAuth2.  There are a couple things to note about this code.</p>
<p> </p>
<p>1.  This Class assumes that your SSO mechanism has already requested a token from the OAuth2 Server and set it as a cookie named "actPassword" and set the OAuth2 username in a cookie called "actUserName".  So you'll notice on line 101 I'm calling getToken().  In implementation you will have already got this token.</p>
<p> </p>
<p>2.  From what I know of OAuth2 there is no standardized way to check if a token is still valid or not.  So take note of checkToken().  If your implementation has no way to ask if a token is still valid, then make a request to some endpoint and if the response is 201 then you can assume it's valid otherwise return false.</p>
<p> </p>
<p>3.  This sample uses a password grant type vs others.  I did this for a couple reasons.  First, I didn't want to redirect the user away from the page when requesting a code that would then be used to generated a token.  Secondly, so I can protect the client_id, client_secret, and other credentials.  By taking this approach I can keep all of this information server side.</p>
<p> </p>
<p>  This is not implementation ready but should give a low level idea of how you can implement something.  In implementation it might look something like this:</p>
<pre class="_prettyXprint">
User Entry Point ---> SSO Mechanism ---> Username/Pass ---> OAuth2 Server
OAuth2 Server ---> Auth Token ---> SSO Mechanism ---> Auth Token Set in Session ---> User Redirect</pre>
<p>  Note that if you do want/need a grant type of code which implements a redirect then you would implement this at login time with your SSO implementation.  Also, take this sample as a grain of salt as I'm sure there are other ways to do this.  Take a look and let me know if you have any questions.</p>

<p>You can defiantly deploy your own JSP pages in the iHub or modify the default login page as discussed in the topic you linked to.</p>
<p> </p>
<p>I'll do a little bit of sample coding and reply back with answers to your specific points you've listed.  But from what I'm understanding of your needs, my first reaction would be to modify the login page to fire a redirect request to a custom JSP page after a code has been generated.  I would store that JSP page either in the same location as the login page or house it in the shipped tomcat that iPortal uses.</p>