Web SSO

Moving between portals should not need any additional work. It will be just a redirect to another portal-secured URL so that portal can initiate OIDC request with HSID when portal session does not exist, and HSID will pick up the existing HSID-authenticated session. This is supported between cloud to cloud or cloud to on prem HSID integrated portals.

However, for the following cases, calling Aikyam Web SSO V2 endpoint helps to re-instantiate HSID authenticated session before moving into another portals.

To use Aikyam Web SSO V2, these steps are required:

• Request an intake for the HSID onboarding team, to set up Web Internal SSO Integration.
  • In principle, this SSO integration configuration should be configured under the “target” portal (where the user is redirected to), due to the web-sso-allowed redirection domain setup. However, if the target portal is not migrated to Aikyam platform, it needs to be configured in “source” portal. Ideally, after the target’s portal’s Aikyam OIDC migration, source portal should use target portal’s Web Internal SSO Integration identifier.
• Once web internal SSO integration is set-up, “source” portal developer can utilize Aikyam eeb SSO V2 endpoint in the following manner:
  • Acquire a fresh ID token by calling OIDC Token endpoint with refresh token.
  • Open a webview / in-app browser / external browser, or stay on the same browser (depending on the application set-up).
  • On that target view, call Aikyam Web SSO endpoint below with the given sso_identifier, ID token, and the destination URL (redirect_uri).
  • The endpoint above will set HSID authentication session cookie on the target view.
  • The destination URL does not have its own portal session; therefore, it automatically starts HSID OIDC. The portal is expected to retain the final destination (either in their unauthenticated session, or some type of deep link parameter in their OIDC redirect_uri) during HSID OIDC.
  • The destination URL does not have its own portal session; therefore, it automatically starts HSID OIDC. The portal is expected to retain the final destination (either in their unauthenticated session, or some type of deep link parameter in their OIDC redirect_uri) during HSID OIDC.