Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# DRM Sign-in: WS-Federation example

The WS-Federation standard supports HTTP GET and POST operation for DRM Sign-in.

# HTTP GET Operations

This is the content for the HTTP GET DRM SSO Sign-in operation.

    https://authenticate.gateway.gov.uk/Protocols/WSFederation/DelegatedSignin.ashx?
    wa=wsignin1.0&
    wtrealm=http://www.gateway.gov.uk/2007/07/delegated&
    wreply=[Reply Address]&
    wctx=State%20information%20to%20be%20persisted%20across%20operation&
    lang=[Language]&
    token=[One-time Token]&
    signouturl=[Sign-Out Address]

#

# HTTP POST Operations

This is the content for the HTTP POST DRM SSO Sign-in operation.

    <form action="https://authenticate.gateway.gov.uk/Protocols/WSFederation/DelegatedSignin.ashx" method="post">
      <input type="hidden" name="wa" value="wsignin1.0" />
      <input type="hidden" name="wtrealm" value="http://www.gateway.gov.uk/2007/07/delegated" />
      <input type="hidden" name="wreply" value="[Reply Address]" />
      <input type="hidden" name="wctx" value="State information to be persisted across operation" />
      <input type="hidden" name="lang" value="[Language]" />
      <input type="hidden" name="token" value="[One-time Token]" />
      <input type="hidden" name="signouturl" value="[Sign-out Address]" />
    </form>

This is the response produced by the CAP for a DRM Sign-in (HTTP GET or POST)

    <form id="gatewayRes" method="post" action="[Reply Address]"
      <input name="wa" type="hidden" id="wa" value="wsignin1.0" />
      <input name="wctx" type="hidden" id="wctx" Value="State information to be persisted across operation" />
      <input name="wresult" type="hidden" id="wresult" value="[RequestSecurityTokenResponse]" />
    </form>

RequestSecurityTokenResponse contains the SAML Assertion (this is not for the target Portal):

    <wst:RequestSecurityTokenResponse xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust">
      <wst:TokenType>urn:oasis:names:tc:SAML:1.0:assertion#Assertion</wst:TokenType>
      <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <wsa:EndpointReference xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing">
          <wsa:Address>[Target Resource]</wsa:Address>
        </wsa:EndpointReference>
      </wsp:AppliesTo>
      <wst:RequestedSecurityToken>[SAML Assertion]</wst:RequestedSecurityToken>
    </wst:RequestSecurityTokenResponse>

RequestSecurityTokenResponse returns an error:

    <soap:Fault xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
      <faultcode xmlns:code="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">code:FailedAuthentication</faultcode>
      <faultstring>The security token could not be authenticated or authorized</faultstring>
      <faultactor>urn:GSO-System-Services:external:1.65:GatewaySecurityTokenService</faultactor>
     </soap:Fault>

Note:

- wtrealm: Contains the Target Resource. In this example (which is typical) it is set to http://www.gateway.gov.uk/2007/07/delegated – a generic value that is only valid for the WS-Federation protocol. Alternatively wtrealm could contain an organisation specific Target Resource (that references an associated organisation Portal Resource File). This is not the Target Resource for the target Portal.
- wreply: Contain the Reply Address - the URL to which the response is sent after the sign-in operation is complete (i.e. within the corporate application). If it is not supplied then it is extracted by CAP from the Target Resource Portal Resource File.
- RequestSecurityTokenResponse is HTML Encoded (i.e. "&lt;" represents "<", "&gt;" represents ">", "&quot;" represents """ and "&amp;" represents "&").
- lang: Identifies the language for displayed pages. For example en-GB for English and cy-GB for Welsh. It is used in in conjunction with the Target Resource value to qualify the Portal Resource File to be used.
- token: Contains the One-time Token returned from GsoDelegateRights. It is used to authenticate the corporate user.
- signouturl: Contains the Sign-out URL to return to when the corporate user signs out.
- Address: Contains the Target Resource value supplied in the Sign-in request.
- The SAML Assertion will be returned using the WS-Federation Passive Requester Interoperability Profile protocol implementation – if the generic target resource (http://www.gateway.gov.uk/2007/07/delegated) is used the assertion content is minimal. The primary significance of receiving the assertion is that it indicates the corporate user has been successfully authenticated.
- The SAML Assertion will be returned using the WS-Federation Passive Requester Interoperability Profile protocol implementation – if the generic target resource (http://www.gateway.gov.uk/2007/07/delegated) is used the assertion content is minimal. However the primary significance of receiving the assertion is that it indicates the corporate user has been successfully authenticated – it cannot be use to directly get a GatewayToken.

© Crown Copyright 2008. All rights reserved