External login page

The external login enables single sign-on over a different domain than the domain of the 446 Plattform^®.

 

Installation

1. Requirements

• An installed .NET framework version 4.7.2 or higher (4.8 from )
• Entry of the host name for the external login page in the DNS The Domain Name System (DNS) is one of the most important services in many IP-based networks. Its main task is to answer requests for name resolution. The DNS works similar to a directory enquiry service. The user knows the domain (the name of a computer on the Internet that people can remember) - for example example.org. He sends this as a request to the Internet. The domain is then converted there by the DNS into the corresponding IP address (the "connection number" on the Internet) - for example, an IPv4 address of the form 192.0.2.42 or an IPv6 address such as 2001:db8:85a3:8d3:1319:8a2e:370:7347, and thus leads to the correct computer. [Wikipedia]
• An Internet Information Server (IIS) Version 8.0 or higher
• The token generator must be activated for the client (Administration > Configuration settings > ActivateSecurityTokenGenerator = True)
• Users must be available via an LDAP import.

 

2. Creating a website

The files are located in the 446 Plattform^® installation package in the subfolder TxpExternalLoginPage. There is a reference configuration file Web.config for this purpose.

The IIS Manager is opened from the Control Panel.

A right click on Sites opens the context menu and Add Website is selected. In the window that opens, the configurations must be made according to the installation:

 

3. Configuration of the login page

The Web.config file, located in the directory where the application was installed, must be modified:

ClientObjectGuid: Available from the master database (Clients table)

UrlToExternalTXPE: - URL of the 446 Plattform^®

ExternalLoginStaticSecurityKey: Available from the master database (table GlobalConfiguration)

value: Link to the PublicWebServices of the 446 Plattform^®

 

Authentication process

1. The client authenticates itself at the external login page in IIS (e.g. via Windows authentication).
2. The external login page forwards this request to the web server that hosts the 446 Plattform^® PublicWebServices. There it is checked whether this user exists.
3. The server returns a token that contains the result of the check (positive or negative).
4. If the authentication is successful, the 446 Plattform^® page is called.

1. If automatic authentication fails for any reason, the 446 Plattform^® login page will be displayed and the user will be able to log in manually.

2. The customer's users must be present in the 446 Plattform^® so that they can be authenticated. The SecurityManager must therefore be given LDAP access for importing (reading) the customer.