| Next revision | Previous revision |
| v:0.7.1:advanced:sso [2011/05/26 09:02] – external edit 127.0.0.1 | v:0.7.1:advanced:sso [2018/02/14 15:19] (current) – [The Details] marija |
|---|
| |
| ===== Alternate Uses of SSO ===== | ===== Alternate Uses of SSO ===== |
| Because of how FoxyCart's SSO functionality works it actually allows for a few interesting options in besides straight single sign-on: | Because of how FoxyCart's SSO functionality works it actually allows for a few interesting options besides straight single sign-on: |
| * Checkout can be made entirely "private", requiring authentication (through your own system) prior to allowing purchase. This could allow for members-only stores or other secure ordering or customer pre-screening opportunities. | * Checkout can be made entirely "private", requiring authentication (through your own system) prior to allowing purchase. This could allow for members-only stores or other secure ordering or customer pre-screening opportunities. |
| * Prior to passing a customer on to the checkout the customer's cart could be retrieved (using the JSONP functionality) and validated to ensure they: | * Prior to passing a customer on to the checkout the customer's cart could be retrieved (using the JSONP functionality) and validated to ensure they: |
| * Redirect the user to the checkout, //not// authenticated; or | * Redirect the user to the checkout, //not// authenticated; or |
| * Take other action, such as redirect the user to a login or registration page, or deny checkout altogether. | * Take other action, such as redirect the user to a login or registration page, or deny checkout altogether. |
| | |
| | ==== Related Functionality ==== |
| | * [[.:transaction_xml_datafeed|Instant XML Datafeed]] (for creating new users from the FoxyCart checkout, or updating existing users). |
| | * [[.:api|The API]], for creating users from your system -> FoxyCart. |
| | * [[..:customers|Customers]], since that's what we actually care about. Pay particular attention to the password hashing section. |
| | |
| | ==== Best Practices ==== |
| | Before we get to [[#the_details|the details of an SSO implementation]], it's important to understand what we consider "best practices" when it comes to SSO. The most important piece that people often miss is that <wrap tip>users can be created from You -> FoxyCart (via [[.:api|the API]]) //and// from FoxyCart -> You (via the [[.:transaction_xml_datafeed|instant datafeed]]).</wrap> |
| | |
| | There are two related but unique user creation flows, then: |
| | - The user adds products to the cart and proceeds through to the checkout all //without// your system knowing who the user is. When the user successfully completes the checkout, your system gets the [[.:transaction_xml_datafeed|instant datafeed]] and creates (or updates, if the user exists already) the user in your database. |
| | - The user registers on your system first, logs in, //then// proceeds through to the FoxyCart checkout, already authenticated via SSO. |
| | |
| | We strongly recommend allowing both options. Though there are situations where you may require a login prior to allowing a customer to add items to their cart (or even to see pricing), in most situations it will only hurt your sales if you require users to create an account prior to completing the checkout. Also, FoxyCart's checkout is arguably one of the most streamlined user registration forms around, and if the customer is going to be entering information you might as well just have them enter it in one place. |
| |
| ==== The Details ==== | ==== The Details ==== |
| The completed redirect might look something like this (in PHP): | The completed redirect might look something like this (in PHP): |
| <code php> | <code php> |
| $redirect_complete = 'https://yourdomain.foxycart.tld/checkout?fc_auth_token=' . $auth_token . '&fcsid=' . $fcsid . '&fc_customer_id=' . $customer_id . '×tamp=' . $timestamp; | $redirect_complete = 'https://yourdomain.foxycart.com/checkout?fc_auth_token=' . $auth_token . '&fcsid=' . $fcsid . '&fc_customer_id=' . $customer_id . '×tamp=' . $timestamp; |
| header('Location: ' . $redirect_complete); | header('Location: ' . $redirect_complete); |
| </code> | </code> |
| Note that if you append any additional fields //after// the required fields above you still must separate the values with an ampersand (''&''). For example, if you're pre-populating the checkout fields: | |
| <code php> | |
| $redirect_complete = 'https://yourdomain.foxycart.tld/checkout?fc_auth_token=' . $auth_token . '&fcsid=' . $fcsid . '&fc_customer_id=' . $customer_id . '×tamp=' . $timestamp; | |
| header('Location: ' . $redirect_complete); | |
| </code> | |
| |
| |
| === What Happens on Error === | === What Happens on Error === |
| * If the SHA-1 hash passed to FoxyCart does is invalid or doesn't match the supplied cleartext values, the user is redirected back to the store's URL (as configured in the store settings). The only way this should happen is if your SSO endpoint is configured incorrectly, or if a malicious user is attempting to manipulate the redirect URL. | * If the SHA-1 hash passed to FoxyCart does is invalid or doesn't match the supplied cleartext values, the user is redirected back to the store's URL (as configured in the store settings). The only way this should happen is if your SSO endpoint is configured incorrectly, or if a malicious user is attempting to manipulate the redirect URL. |
