Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# DRM Sign-in operation

#

The following lists the steps to sign-in (authenticate) an organisation internal user (i.e. a corporate user) so they can act on enrolments delegated to them:

1. Corporate user accesses corporate application to request/use specific enrolment(s).
2. Corporate application calls the GsoDelegateRights method (see Calling the DelegatedRights SOAP Interface) specifying the enrolments to be delegate to the corporate user for this DRM session.
3. Corporate application initiates/redirects the corporate user's browser session to the CAP DRM sign-in endpoint (https://authenticate.gateway.gov.uk/protocols/[PROTOCOL]/DelegatedSignin.ashx) with the following information:
   - Target Resource:
     - For the WS-Federation protocol this would normally be the generic http://www.gateway.gov.uk/2007/07/delegated value. Alternatively an organisation could reference a Portal Resource File specific to the organisation.
     - For the Liberty Alliance or SAML 1.1 POST profile protocols this must reference a Portal Resource File specific to the organisation.
   - Reply Address - URL to which the response is sent (i.e. within the corporate application). For the Liberty Alliance or SAML 1.1 POST profile protocols this value is not passed as a parameter, it is extracted by CAP from the Portal Resource File – this is why these protocols cannot use the generic Target Resource.
   - One-time Token - returned from GsoDelegateRights (step 2 above) and used to identify/authenticate the corporate user in DRM session.
   - Sign-out Address - where to return to when the corporate user signs out from the target Portal.
4. CAP creates SSO session cookie and stores the Sign-out Address. The corporate user is not presented with a sign-in page.
5. CAP renders an HTML form which includes a SAML Assertion back to the browser – however since it is not for the target (i.e. destination) Portal, its role is primarily to provide a positive acknowledgement:
   - Browser (automatically executes embedded JavaScript and) submits the SAML Assertion back to the corporate application (i.e. the Reply Address specified in step 3) through a HTTP POST.
6. Corporate application checks the response from CAP and unless an error is returned (rather than the "acknowledgement" SAML Assertion) redirects the user's browser (by supplying the appropriate URL) to the target Portal.
7. Portal follows the normal SSO sign-in operation when the corporate user attempts to browse to a secure area – however they are not prompted to login. CAP returns a SAML Assertion to the Portal.

The SAML Assertion gives the Portal the corporate user's details and the enrolments that they have access to through this Portal (filtered by the set of allowable enrolments specified in GsoDelegateRights) and their authentication level.

If the Portal needs to call SOAP methods on the Gateway it can use the SAML Assertion to get a GatewayToken through STS. However the only methods that can be called are:

- GsoGetUsersDetails – oonly the version for release 2.2 of the Gateway returns the DRM specific information
- GsoGetClientAllocationList
- GsoGetAssignedEnrolments

> The results are filtered by the set of allowable enrolments specified in GsoDelegateRights.

Note: When the user logs out of the Portal the Sign-out Address originally supplied will be used to return the corproate user back to the organisation.

© Crown Copyright 2008. All rights reserved