Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Calling Methods using a GatewayToken

A GatewayToken can be obtained by presenting a UsernameToken or an X509SecurityToken in a RequestSecurityToken message (see Web services security specifications) to the Security Token Service (STS). If the call is successful and the credentials presented are valid, then the STS will return a GatewayToken in the RequestSecurityTokenResponse message. This GatewayToken can then be used to call methods on the Gateway SOAP Portal and Public Interfaces for a four hour period.

RequestSecurityToken messages that incorporate an X509SecurityToken are signed with the private key (of the certificate) to prove ownership.

RequestSecurityToken messages that incorporate a UsernameToken are not signed with the UsernameToken. Also, when the STS returns the GatewayToken, the calling portal needs to check the usage of that token. If the credential associated with the UsernameToken has an expired password, the GatewayToken returned will have a usage of 'ExpiredPassword' instead of 'Standard'.

The expired password token is valid for ten minutes, and can only be used to call the GsoSetExpiredPassword method on the SOAP Portal Interface. Once this method has been called the user will have to present a new UsernameToken with their new password to the STS to get a GatewayToken with a usage of 'Standard'.

Getting and using a GatewayToken is covered in Logging on Gateway with a User ID and Password, Logging on to Gateway with a Certificate and Example of Using a GatewayToken to Get a User's Details.

© Crown Copyright 2008. All rights reserved