Multipass SSO

What is Multipass SSO?
Multipass SSO is a Single Sign-On method in which the organization's own systems build an AES-encrypted JSON hash of member data and pass it to IdeaScale, either in the URL or as a parameter in a POST form, to authenticate the member.

Multipass SSO authenticates a member by encrypting a JSON hash of that member's data using the Multipass Site Key and Multipass API Key, then submitting the encrypted hash to IdeaScale. This article covers the technical structure of the Multipass hash and how it is built, encrypted, and submitted; for configuring the connection itself within IdeaScale, see the Token-Based/Multipass SSO article referenced below.

---

Role Permissions

1. Workspace Administrator: Retrieves the Multipass Site Key and Multipass API Key from Single Signon Settings. These keys are used as inputs when the organization's developers build and encrypt the Multipass hash described in this article.
2. Community Administrator: Can enable or disable SSO in their community that is set up by the Workspace Administrator.
3. Member: Authenticates through the organization's Multipass connection once implemented, rather than logging in with separate IdeaScale credentials.

---

---

Multipass Structure

A Multipass is a hash of keys and values, provided to IdeaScale as an AES-encrypted JSON hash. The hash is built from the following keys:

1. name: The name of the member.
2. ssoId: The member's login ID (username or email).
3. email: The member's email address.
4. expires: The token's expiration date, in ISO-8601 format (e.g., yyyy-MM-dd'T'HH:mm:ss.SSSZ).

---

Building the Multipass

1. An expiration date is chosen for the hash, such as five minutes from the current time (e.g., 2011-05-04T12:34:56.789-0700).

2. A JSON hash of member data is constructed, for example:

   {"ssoId":"john.ideascale.com","email":"[email protected]","name":"John Doe","avatar":"http://myimg.com/my.jpg","expires":"2011-05-04T12:34:56.789-0700"}

3. The JSON hash is encrypted with an AES key, using the Multipass Site Key as the password and the Multipass API Key as the salt. The initialization vector (IV) used should be 16 bytes of zeros. The encrypted result is Base64 encoded.

4. Because Base64 strings are passed around the web, IdeaScale recommends converting the result to a URL-safe variant, though a standard Base64 string that is properly escaped for URLs also works. Converting to the URL-safe variant involves:

• Removing newlines (matching regex: (\n+))
• Removing trailing = characters (matching regex: (=+)$)
• Converting + characters to - (matching regex: (\+))
• Converting / characters to _ (matching regex: (\/))

---

Additional Parameters

Custom Fields

Member custom fields can be populated using the Multipass token. Custom field data is passed as label-value pairs in a dictionary/hash named attributes, with each custom field's label as the key and its value as the value. For example:

{"email":"[email protected]","name":"John Doe","attributes":{"location":"Berkeley","department":"IT"},"expires":"2011-05-04T12:34:56.789-0700"}

Groups/Departments/Subscription Lists

Community Role is a feature that defines a member group, used to restrict access to private campaigns or to apply member groups within features such as Polling, Assessment, or Idea Comparison. See Exceptions below for licensing requirements.

If the organization maintains its groups in its own Directory server or user database, that information can be passed to IdeaScale using the Multipass token, keeping the groups fully in sync. The Multipass token can contain the group names of which the member is a part, passed as an array named groups, mapping one-to-one to Community Role in IdeaScale. For example, for a member who belongs to "Group1" and "Group2":

{"email":"[email protected]","name":"John Doe","groups":["Group1","Group2"],"expires":"2011-05-04T12:34:56.789-0700"}

If the Community Role named in the token does not already exist, it is created. If a Community Role with the same name already exists, it is converted to an SSO Managed Community Role.

 

---

Authentication Outcome

1. If authentication is successful, the member is created (if new), logged in, and redirected to the IdeaScale community URL (e.g., https://company.ideascale.com).
2. If authentication fails, the member is redirected to the login page.

---

HTML Request Example

POST /a/community/auth HTTP/1.1 Host: company.ideascale.com Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded  multipass=dHXSsQNl7sty-aGTckmEamrS4shK5thUPnOl2HCyJSlZ90b9oiAymW2QmDYhE0jBWis6pLavvOsurmQ8NUoWxYtXuxzJtY4glTPJFT0yX20tLuQyIHGcJmKlzZ0CwuGAwbwmTQbBjB_6lRmOg5ZlszyU_RO2gCYwKlbeySx3bv98MRnavKJsMF593bPEHStCy497DTpsPapuJhSgwC6cvsKgzBChmpkvgfVMNfMSEEG1f4a8JKm5_kGGoJOMqNe

---

Multi-Pass Code Samples

A repository of IdeaScale-compatible Multipass/SSO implementations is available on GitHub (https://github.com/ideascale/multipass#readme), with examples in the following languages:

1. Java
2. Python / Google App Engine
3. Ruby
4. C# / ASP.Net
5. VB / ASP.Net
6. ColdFusion
7. Objective-C

---

Exceptions

1. Enterprise License Required: The Community Role feature used for Groups/Departments/Subscription Lists mapping via Multipass token is available to Enterprise license holders only.

---

Frequently Asked Questions

What DES encryption mode should be used?

The ECB mode should be used (TO BE VERIFIED — the source describes the core Multipass hash as AES-encrypted, but this answer and the sample code below reference DES encryption, which is inconsistent with the AES method described in Building the Multipass; this may reflect legacy or alternate implementation guidance).

Which padding mode should be used?

The PAD_PKCS5 padding mode should be used.

Is there a way to test the Multipass configuration?

Yes. The following URL can be used to test the setup: http://[community_url]/a/jsp/useradmin/cookie-test.jsp

Sample DES encryption code (Java):

java

public static String encriptDES(String passPhrase, String value) throws Exception {     SecretKey key = new SecretKeySpec(passPhrase.getBytes(), "DES");     // Create the ciphers     Cipher ecipher = Cipher.getInstance(key.getAlgorithm());     // Encode the string into bytes using utf-8     ecipher.init(Cipher.ENCRYPT_MODE, key);     byte[] utf8 = value.getBytes("UTF8");     // Encrypt     byte[] enc = ecipher.doFinal(utf8);     // Encode bytes to base64 to get a string     return new sun.misc.BASE64Encoder().encode(enc); }  public static String decriptDES(String passPhrase, String value) throws Exception, IllegalBlockSizeException {     SecretKey key = new SecretKeySpec(passPhrase.getBytes(), "DES");     Cipher dcipher = Cipher.getInstance(key.getAlgorithm());     // Create the ciphers     dcipher.init(Cipher.DECRYPT_MODE, key);     byte[] dec = new sun.misc.BASE64Decoder().decodeBuffer(value);     // Decrypt     byte[] utf8 = dcipher.doFinal(dec);     // Decode using utf-8     return new String(utf8, "UTF8"); }

---

Related Articles

• Help Article for Token-Based/Multipass SSO
• Help Article for Workspace Single Sign-On Settings
• Help Article for SSO Debugger