...
| Table of Contents | ||
|---|---|---|
|
...
1
...
- SSO, what for?
SSO allows for users to launch your application directly from a the platform's dashboard without having to type in credentials. This enhances credentials (enhancing the user experience of customers by skipping a step to access your app.
...
)
2 - A user launches your application for the first time from
...
their dashboard, what next?
When accessing your application for the first time, a new account must be created based on the incoming user details including (first and name, last name, email, company name etc...). You also may have different subscription plans to be offered to the user. The recommended approach is to setup
To encourage uptake, Maestrano strongly recommend the user account is setup under a free trial if you support this kind of subscription. Otherwise it is recommended to provide the user with a basic subscription plan so he can try out your application functionalities. After the free trial has expired, the user will under an applicable subscription tier(if supported). Once the free trial has lapsed, the user can be charged via the billing Billing API.
As part of the SSO process, the user details are passed on (first and name, last namesname, email etc). You can decide to use these this to match the user against an existing user inside your application rather than creating a new account. This will give the end user a better user experience.
3 - What is the Workflow?
- The Single Sign On process is initiated from
...
- the platform when a user clicks on your application from
...
- their dashboard
- The user is redirected to the configured SSO initialization endpoint which then redirects back to the marketplace IDM endpoint
...
- The user is then redirected to your SSO consume endpoint with all the User details required to either log the user in or create a new account.
The Note: the SSO Init Path and Consume Path are configured in the developer platform per environment in the technical sectionour dedicated Maestrano Developer Platform per environment (as pictured below).
Figure 1 -The Maestrano Developer Platform → Technical Section
These path should contains a variable that will indicate the correct marketplace, the endpoint then will retrieve the marketplace variable from the url.
...
Consume Method
Maestrano will first check that everything is in order and then do a POST request to the SSO Consume Path url containing all the required information to identify the user and his organization connecting to your application.
...
Examples in
4 - What do I have to pay attention to?
The uid specified in the SSO request is an User identifier. It must be stored against the User record on your side so even if a user changes its their email, you can still uniquely identify its their account. The uid is unique per marketplace - not cross marketplaces.
The group_uid specified in the SSO request is an identifier of an account in your application. It will help you to assign the Users against the Company/Organization they belong to as well as the identifier used for the Connec!™ data-sharing. You need to store this value against the user company inside your application. The group_uid is unique per marketplace - not cross marketplaces.
On a platform, a User can be part of multiple Companies (one uid for more for more than one group_uid) and a Company can have multiple Users (several uid for the same group_uid). We ask every application on to respect this norm, and to help you implement that, we propose you virtual use virtual ids on our SDKs that are unique for a user and a company (not cross marketplaces).
...
| Warning | ||
|---|---|---|
| ||
The virtual email addresses should only be used to create a unique user id, not to send emails to users; for that, you can always reach the user's real email. |
5 - SSO Consume process
