Meridix Studio supports single sign on (SSO) from external systems. There are two ways to allow an external system to automatically log in users into Meridix Studio without the users needing to manually input their credentials.
| Table of Contents |
|---|
Signed - Recommended
The recommended method to log in users is to make a signed request (same signing mechanism as with the Web API) to the URL https://[meridixurl]/SSO?u=[username] but before sending it use a ticket from Meridix Studio (token/secret) to sign the request resulting in a signed URL ex:
...
| Note |
|---|
| This feature is not recommended and are disabled by default and must manually be enabled in Meridix Studio to work. [system-property: ui.sso_basic_insecure_enabled] |
Additional options
You also have the abbility to set the user interface language when logging in a user by using the query string key langage={language_code} where language_code is set to either sv-SE for swedish or en-US for english. If not supplied the system uses the to be logged in users setting.
At the time of writing only english and swedish is supported. But more langages will be supported in upcoming releases.
On failed SSO login
...
Responses
The SSO interface will return one of the following HTTP status codes will be returned. depending on the result of the authentication operation.
Response: 302 - Found
If the SSO request is was valid the HTTP status code 302 Found is returned with the Meridix authentication cookies set. The response also contains a Location header causing browsers to redirect to the logged in users startpage.
http://en.wikipedia.org/wiki/HTTP_302
Response: 403 - Forbidden
The HTTP status code 403 Forbidden will be returned with an additonal status message descripting why the request was denied. An example of a reason can be Nonce already consumed that is returned if the nonce/token used for the signature already have been consumed during the timstamps allowed interval.
In additon to the standard response status message a response header with the key API.403_reason is added with the same response.
http://en.wikipedia.org/wiki/HTTP_403
Response: 400 - Bad request
The HTTP status code 400 Bad request will be returned if the request was in an invalid format if for example the request has missing query strings. A status description message is also added describing the reason for the 400 code.
In additon to the standard response status message a response header with the key API.400_reason is added with the same response.
http://en.wikipedia.org/wiki/HTTP_400
Additional options
You also have the abbility to set the user interface language when logging in a user by using the query string key langage={language_code} where language_code is set to either sv-SE for swedish or en-US for english. If not supplied the system uses the to be logged in users setting.
At the time of writing only english and swedish is supported. But more langages will be supported in upcoming releases.