Pre-authentication Web SSO data

Internal window of the Applications module

This window is reached from the Applications module, on an application whose service type is Web and whose SSO type is Pre-authentication: the Configure pre-authentication steps button opens the list of steps, where the add button sub-menu offers to add a data creation step. The window carries a help icon that opens the module help page.

The Pre-authentication Web SSO data window lets an administrator define a piece of data that the Mediation Controller must store in the browser (local variable, session variable or cookie) before the final pre-authentication phase of a Web SSO application.

Form fields

Field	Description
Type	Mandatory, non-editable drop-down. Choices: Local variable (default), Session variable, Cookie. The selected value drives the display of the cookie-specific fields below.
Name	Mandatory. A whitespace-only string is rejected. Identifies the data.
Value	Value to store. By default it may carry elements interpreted by the pre-authentication engine: a message below the field recalls that This field follows a special syntax. Please consult the help page for more informations. See section Special syntax of values.
Disable special syntax	Checkbox. Once checked, the value is taken as is and the syntax message disappears. Entries created with this option are shown in italics in the list of steps.
Handle as JSON data	Checkbox. The value is then treated as a JSON object rather than a string.

The Type determines where the data is stored:

Type	Location
Local variable	Local storage of the browser.
Session variable	Session storage of the browser.
Cookie	A cookie set on the browser, with the fields of section Cookie-specific fields.

Cookie-specific fields

When Type is Cookie, four extra fields appear and the window grows:

Field	Description
Path	Restricts the cookie to the URLs matching the given path. Default value /, which makes it available on every URL; a leading / is added on save when the entry does not carry one.
Lifetime (hours)	Integer. The expiry date is computed when the SSO runs, by adding this lifetime to the current time. ⚠ A zero or negative value makes the cookie expire immediately. Left empty, no expiry date is sent and the cookie becomes a session cookie.
Secured cookie	Checkbox. The cookie is then only usable when the connection to the site is secured (HTTPS).
SameSite	Non-editable drop-down: Strict, Lax (default) or None. Defines how the cookie behaves with requests coming from another site.

Special syntax of values

The Value field accepts substitution strings, replaced when the SSO runs. The same syntax applies to the parameters, headers and bodies of pre-authentication requests.

Substitution	Effect
%user%	Login to use for the SSO.
%password%	Password to use for the SSO.
%base64([...])%	Encodes the content of the brackets in base 64.
%lowercase([...])%	Turns the content into lowercase.
%uppercase([...])%	Turns the content into uppercase.
%trim([...])%	Removes leading and trailing whitespace from the content.
%uriencoded([...])%	Replaces uncommon special characters with their UTF-8 encoding, for use in a URL.

Encryption functions are available as well:

Function	Expected parameters
%sha256([...])%	The data to hash (SHA-256).
%md5([...])%	The data to hash (MD5).
%hmacmd5([...])%	Two parameters: the data to encrypt, then the encryption key.
%rsa([...])%	Two parameters: the public key, then the data to encrypt.
%rsaoaep([...])%	Two parameters: the public key in PEM format, then the string to encrypt.
%reqresult([...])%	The sequence number of the request whose result must be reused and, optionally, the name of the key to pick when that result carries several parameters.

Two writing conventions

Function parameters are separated by %,%. To enter a literal percent sign, write \%.

Saving

Click Validate to add or update the data in the current pre-authentication step. Cancel closes the window without saving.