Overview

This document provides technical specifications for authenticating profiles via the membes Single Sign On (SSO).

Enable SSO

The customer can request SSO be enabled by logging a ticket in the Help Desk

Via login from third party software

Use this process for a link from third party software to a login form where user is authenticated with both membes and third party software.

Prerequisites

1. Membes API

   1. The Membes API incurs a setup and ongoing fee (provided on request), the customer can request access by logging a ticket in the Help Desk or emailing support@membes.com.au.

2. API Keys and ClientID

   1. Membes will provide the API keys and ClientID after the API has been enabled.

3. Callback URL

   1. To be provided to Membes by the third party software provider.

   2. Email the callback URL to support@membes.com.au.

SSO Process

• Client ID

  • referred to as [[client_id]] in this document.

  • This is provided FROM Membes

• Callback URL

  • referred to as {{callback_url}} in this document.

  • Provided TO Membes via the Helpdesk.

SSO Process

1. Direct user to SSO form (login form)

   1. https://[Customer{{customer_website_url]}}/member/oauthlogin/?redirect_uri=http://{{callbackurl}}&client_id=[Membes[client_orgIDid]]&state=[callbackoptional_internal_state]

   2. This call will respond with a display login form .in the users browser

2. On Submission of login by the user via the SSO form

   1. User is authenticated with Membes AMS.

   2. User is directed redirected to [{{callback_url]}}.

3. Callback The callback to [{{callback_url]}} will contain the following parameters

   1. ?code=[access_token]

   2. &state=[callbackoptional_internal_state]

Refresh token

Access token is valid for one hour. Optionally, a refresh token can be obtained from the Membes API.

1. https://api.membes.com.au/api/oauth2/?refresh_token=[refreshtoken]

2. Response: { status: true, "access_token": "xxxx-xxxx-xxxx" }

Membes API

Once access token has been obtained, further information about the authenticated user can be obtained from the Membes API.

To request access token for the API:

1. https://api.membes.com.au/api/oauth2/?code=[callback_token]&client_secret=[client_secret]

2. Response: { status: true, "access_token": "xxx-xxx-xxx-xxx", "refresh_token": "yyy-yyy-yyy"}

1. 1. (passed through from step 1)

   2. &profileID=[profile_id_of_authenticated_user]

   3. &email=[primary_email_address_of_autenticated_user]

   4. &status_id=[membership_status_of_autenticated_user] (0 = No, 1 = Active Member, 2 = Inactive Member)

Although the Membes API is not a prerequisite for the Membes SSO, the Membes API could be used from this point to retrieve or update profile details.

User Logout

To log a user out from his/her their session in Membes:

1. https://[{{customer_website_url]}}/member/oauthlogout

2. Response: { status: true }

Access third party software via link on website

Use this process if you want to provide a link to the third party software from a user already logged into their Membes website.

Prerequisites

1. Membes API

   1. The Membes API incurs a setup and ongoing fee (provided on request), the customer can request access by logging a ticket in the Help Desk or emailing support@membes.com.au.

   Authentication Secret

   Membeswill provide the authentication secret after the API has been enabled.

   API Url

   1. The URL for the Membes customer API. [membesapiurl] (https://documenter.getpostman.com/view/9582776/TzzDKahF#ec358997-598a-4e21-98b7-eecf26dff12b#intro )See Membes API

Creating the Link in website

1. Login to Membes admin > CMS.

2. Navigate to the page that you want to place the link to the 3^rd party software in.

3. Make sure the page is set to require requires login, as the user must be logged in for the Authenticated URL to be generated.

4. In the href parameter of the link, place the following shortcode:

   Code Block
   [code]Application.util.authLink("www.yoursite.com")[/code]

This shortcode, when rendered, will generate a url containing a JWT Token as a url parameter called “membes_token”.

e.g. https://www.yoursite.com/?membes_token=[jwttoken]

When the logged in user clicks the generated link they will be sent to “https://www.yoursite.com” with the token appended to the URL.

Validating the Token

When you receive a request to http://yoursite {{customer_website_url}} with membes_token in the URL, you then validate this token via the Membes API at [membesapiurl].

1. Send token to (https://documenter.getpostman.com/view/9582776/TzzDKahF#ec358997-598a-4e21-98b7-eecf26dff12b ): GET https://[membesapiurl]/api/token/validate/[jwttoken]

2. Response will be JSON format:

{ 
  valid: true|false,
  data: {
    id: [membes PK],
    profileNumber: [profileNumber],
    firstName: [first name],
    surname: [surname],
    email: [primary email address],
    membershipType: [membership type as string],
    membershipTypeID: [membership type as ID],
    membershipStatus: [membership status as string (--, Active, Inactive) ],
    membershipStatusID: [membership status as ID],
  }
}