Guys.
I need to configure ADFS running on server 2012 R2 to work with a company called Hollaroo. Below is the only setup notes i have on how to configure SSO to work with them. They have no notes at all on how to get this working with MS ADFS so i am a little
stuck. I have other Relying Party Trusts working just fine.
I do have the info for the SsoClientId , SsoPassword , SsoTimeOut
Based on their notes what is the best way to get this working in ADFS?
Hollaroo SSO Standard Setup
The Hollaroo system supports user authentication via a 3<sup>rd</sup>-party system (SSO). The typical use case is for the user to authenticate themselves on a client intranet and then access Hollaroo via a link from the intranet. Clicking
the link triggers the generation of an encoded string which is then used by the Hollaroo system to identify and authenticate the user so they can be logged in without entering any other credentials.
This document details the steps required by Hollaroo and the client to enable SSO.
Hollaroo SSO Setup Parameters
These need to be configured in Hollaroo and then shared with the client. The timeout parameter needs to be agreed.
- SsoClientId -- ANY string that will be shared with the customer (e.g. YourCompany)
- SsoPassword -- ANY string that will be shared with the customer (e.g. secretStringThatIsTough2Guess)
- SsoTimeOut -- number of minutes the client's SSO link is valid, suggested value: 60 (1 hour) - 1440 (1 day)
SSO String Generation (Client Side)
When the authenticated user clicks the link to access Hollaroo from a client site the client technology needs to generate the authentication
string and send that to Hollaroo. There are three steps, generating an XML string with candidate credentials, encoding it using the SSO pollarooarameters previously shared and then sending it to Hollaroo.
XML Generation
An XML string needs to be generated containing the following information:
- Date Created - this will be compared against the "SSOTimeOut" in setup
- ClientId - this MUST MATCH the ClientId in setup
- Email Address - this is the email address of the user to be authenticated via SSO
The following format should be used.Note: line breaks are for ease of reading only, they are not required in the actual document
<?xml version="1.0" encoding="UTF-8"?>
<SSO-Token userId= "not used" utcdatetime="Date-Created">
<ExtensionElements>
<Element name= "clientid" type= "string">ClientId-From-Setup</Element>
<Element name="email" type="string">EmailAddress-of-User</Element>
</ExtensionElements>
</SSO-Token>
String Encoding
The SSO-XML is encoded using SHA256 encryption with SsoPassword from the setup as encryption password. The sample code at the end of
this document can be used for this purpose.
Sending String to Hollaroo
The resulting string is used as the value of "SSO"-parameter in the redirect string – CLIENTURL/sso?sso=ENCODEDSTRING. For
example in our test system, http://tn.hollaroo.com, the url would
look like:
http://tn.hollaroo.com/sso?sso=ZtnKipQnYZWMxpuwNFkB/bcmTAshjFSi1PaGeHg+w2ZxO8iZbku7rRXdQ5S8WbkgGQGtwQE9ym/j4lSn7NaBQyC76hgDDZBqeFoqvnlIKGWnsCN412M5vre4Gh5FzXAZPr+Td6e8ZFNsW4KSHA2564Oi+Vkay2Y5TzctYU+ZOCwtRl3dQRLVKJfs2lTHSVfMJS9GTMZxEGP/5xv4fm1Sp8lBv5A56v7Ef9RyLDne2j0s+WJus/S+Nd2Snxj/uu6Y8kbMLB7HRzdRLO6S+ex10gMc0Ne3529owd1QsB41ZPAZMF9w7O2m3G/m4xbY2RVVQ2kzzCLaPzcQQVfuDZI6oaM6HerbINggM61cHB9sdZSHKo1w1m+lNMyWZyazW1LgV4kzxtNwm/FjAi8jT4/OEuk4g==
The Hollaroo system decrypts the sso string, checks that the timestamp is within limits and then logs in the user with the matching email address.
The following code is an example of how to generate the encoded string. The "strKey"-parameter is the SsoPassword from the
setup.
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
namespace SSOEncoding
{
public class AesEncryptor
{
public static string Encrypt(string strToEncrypt, string strKey)
{
try
{
var objAesCrypto = new AesCryptoServiceProvider();
var objHashSHA256 = new SHA256CryptoServiceProvider();
var byteHash = objHashSHA256.ComputeHash(Encoding.ASCII.GetBytes(strKey));
objAesCrypto.Padding = PaddingMode.Zeros;
var iv = new byte[16];
Buffer.BlockCopy(byteHash, 0, iv, 0, 16);
objAesCrypto.Key = byteHash;
objAesCrypto.IV = iv;
objAesCrypto.Mode = CipherMode.ECB; //CBC, CFB
byte[] byteBuff = Encoding.ASCII.GetBytes(strToEncrypt);
return Convert.ToBase64String(objAesCrypto.CreateEncryptor().
TransformFinalBlock(byteBuff, 0, byteBuff.Length));
}
catch (Exception ex){}
}
public static string Decrypt(string strEncrypted, string strKey)
{
var objAesCrypto = new AesCryptoServiceProvider();
var objHashSHA256 = new SHA256CryptoServiceProvider();
var byteHash = objHashSHA256.ComputeHash(Encoding.ASCII.GetBytes(strKey));
try
{
objAesCrypto.Key = byteHash;
objAesCrypto.Mode = CipherMode.ECB; //CBC, CFB
objAesCrypto.Padding = PaddingMode.Zeros;
var iv = new byte[16];
Buffer.BlockCopy(byteHash, 0, iv, 0, 16);
objAesCrypto.Padding = PaddingMode.Zeros;
objAesCrypto.IV = iv;
var byteBuff = Convert.FromBase64String(strEncrypted);
var strDecrypted = Encoding.ASCII.GetString(objAesCrypto.CreateDecryptor().TransformFinalBlock(byteBuff, 0, byteBuff.Length));
return strDecrypted;
}
catch (Exception ex){}
}
}
}