Single sign-on script in Digital Access

1. Log in to Digital Access Admin with an administrator account.

1. In Digital Access Admin, click Browse.

2. Upload the provided files (without changing the file names) to access-point/custom-files/scripts

1. In Digital Access Admin, go to Manage Resource Access.

2. Click Global Resource Settings.

3. Go to the Filters tab and click Add Filter...

4. Add these three filters and configure them as follows:
   

   • sso_set_username

     Configure sso_set_username

     Display Name: sso_set_username
     Script name: sso_set_username
     Type of Filter: Request
     Resource host: Difficult SSO Resource
     Path: login_form.aspx
     Apply Filter To: Content
     Content Type: *

     
     

   • sso_set_password

     Configure sso_set_password

     Display Name: sso_set_password
     Script name: sso_set_password
     Type of Filter: Request
     Resource host: Difficult SSO Resource
     Path: login_form.aspx
     Apply Filter To: Content
     Content Type: *

     
     

   • Inject_script

     Configure inject_script

     Display Name: inject_script
     Script name: inject_script
     Type of Filter: Response
     Resource host: Difficult SSO Resource
     Path: login_form.aspx
     Apply Filter To: Content
     Content Type: *

     Script variable: setTimeout(function() {document.getElementById("Password").value="secret_password";
     document.getElementById("Username").value = "secret_username";document.getElementById("LoginButton").click();}, 100);

     For help, click the ?-sign.

Information about the filters

This table gives information about the filters:

Regarding the path

The path should be the target of the post, that is, what the form is configured to post its reply to. No web service is equal to another and sometimes this might not be a possible approach. The web page may post back to itself for example. So if a path can not be used, for whatever reason, use a * as path. This means that all requests will be inspected. In that case it is better to replace the dummy strings with something that will not under any circumstances be posted, to make sure not to replace other values. It could, for example, be that the web service actually has a reference to the string secret_username and in that case secret_username should be replaced with something random. For example, replace secret_username with hag_secret_username_lesuhfow8h2. The scripts must be edited accordingly. In the case of problems or questions contact Nexus Technical Support.

Regarding the script variable in Inject_script

The getElementById function calls are searching for the form fields Password, Username and LoginButton in the HTML of the login form. These are most likely named differently in other systems and must be updated accordingly by inspecting the HTML of the login form of the system that should be provided with SSO. These are typically the input fields where the user gives his/her credentials.

Update the inject form script to introduce the script configured above (in the inject_script filter) in the correct position in the HTML.

1. In Digital Access Admin, click Browse.

2. Navigate to access-point/custom-files/scripts.

3. Edit inject_script.wascr.

   CODE

   [root]
   STRING="</body>";def
   ACTION=del("7"),ins("<script>"),ins(script), ins("</script></body>");0
   TRANS=root;root

4. Find a place in the HTML to inject the script with correct syntax and without modifying functionality. This might not be trivial and sometimes changes to existing scripts may be needed. The above approach should however work in most conditions (find the end body tag and insert it just before the end).

The language above is called wascr and is somewhat complex. Basically the above script will do the following:

• Search for the string </body> in the html file.

• Delete 7 characters.

• Insert "<script>"

• Insert what is contained in the script variable (configured in the filter screen above)

• Insert "</script>"

• Insert "</body>"

1. In Digital Access Admin, go to Manage Resource Access.

2. Click Web Resources.

3. Mark the web resource and click Edit Resource Host...

4. Check Enable Single Sign-On.

5. Select Script as Single Sign-On Type.

6. Select SSO Domain.

7. Click Save and then Publish.