Child pages
  • SSP Signed URL SSO
Skip to end of metadata
Go to start of metadata


As of v2.5.2 and 2.6.0, SSP ships with a IMS LTI Provider implementation which provides effectively equivalent functionality as the mechanism described here, but in a standards-based way such that no custom development is typically required to achieve the same goals. Be sure you have a good reason to rule out the LTI provider before embarking on a implementing a client for the SSO protocol described below. (Even if you're not running 2.5.2+ or 2.6.0+, back-porting the LTI provider may end up being simpler and certainly cheaper to maintain over the long term than writing a custom "Signed URL SSO" client.)

Beginning with SSP versions 2.0.0-b3 and 1.2.2, SSP supports a simple single-sign-on (SSO) protocol based on signed URLs. Historically it has been used primarily for "deep-linking" from a LMS to the SSP Early Alert creation form.

To use this feature, clients submit signed URLs via HTTP POST via back-channel requests (i.e. not via the end-user browser), to which SSP will respond with a JSON object containing a temporarily authorized URL to which to redirect the end-user's browser.

This document describes how to enable this feature in a SSP deployment and invoke it from an external system.



The following properties in {ssp-platform-src}/uportal-war/src/main/properties/ configure the SSO feature. Aside from forking and editing that file inline (a bad idea), properties set to ${environment.*} can be overridden in two different ways, depending on the version of SSP you're running:

  1. Prior to v2.2.0: At build time by setting corresponding values in your environment-specific filters file ({ssp-platform-src}/filters/*.properties).
  2. With v2.2.0+: At run time by setting corresponding values in ({SSP_CONFIGDIR}/

For v2.2.0+, check {ssp-platform-src}/uportal-war/src/main/resources/properties/ for defaults.

## SSO Properties

Starting with v2.5.2, the property also needs to be set to a non-empty value in {SSP_CONFIGDIR}/ You can choose any value you like and it needn't be terribly complex: a banking-style PIN should be sufficient. If you are also using the LTI integration, a corresponding value needs to be set in SSP configuration. See the LTI provider documentation for more detail.


This setting should be set to true in production. It forces the SSO exchange to take place over SSL. Default is true.


This value is used in the MD5 hashing process (see below). Choose something secure and reasonably long. This value will need to be shared with clients integrating via this SSO feature. If this left empty, the SSO feature will be effectively disabled. Default is empty (disabled).


Sets the maximum amount of time in minutes for which a temporarily authorized redirect URL is valid. Default is 5.


Boolean. If true, signed backchannel request must include a timestamp to prevent replay attacks. If false, the timestamp can be included and, if present, will be included in the signature validation, but needn't pass a "freshness" check. Default is true.


If checkTimeStampRange is true, timestamps sent on signed backchannel requests must evaluate to a time within this number of minutes (plus or minus) of current server time. Default is 5.


To use this feature, you must obtain a URL from the SSO service using a signed backchannel, i.e. server-to-server request. This request must be a HTTP POST. Two styles of URL are supported, one with query params appropriate for targeting the SSP Early Alert creation form, and one for targeting the user's default SSP Platform view. Security-related parameters are the same for both URL styles.

Invocation - Identifying End User

The SSO-ing end user can be identified with either of two parameters sent on the server-to-server URL:

  1. username - Identifies the end user by her "Net ID", i.e. the value she would normally key into a login form. Should correspond with person.username and v_external_person.username in the SSP database. This was the only end user identifier supported pre-2.5.0.  If present, schoolId is ignored.
  2. schoolId - Identifies the end user by an immutable identifier, which may or may not be known to the end user. Should correspond with person.school_id and v_external_person.school_id in the SSP database. Support for this field was added in 2.5.0. Ignored if username is present.

For example:

# End user identifier via 'username'
# End user identifier via 'schoolId'

Invocation - Targeting Early Alert Portlet

Here are example server-to-server URL that will generate a temporarily authorized URL pointing to a pre-populated SSP Early Alert form. (URLs are artificially wrapped for readability)

Example SSO URL
# formattedCourse only roster/section identifier supported pre-2.5.0
# studentUserName supported added in 2.5.0
# termCode supported added in 2.5.0
# sectionCode supported added in 2.5.0

To target a roster/section, specify one of the following parameter combinations:

  1. formattedCourse - Will yield unpredictable results unless v_external_faculty_course.formatted_course and v_external_faculty_course_roster.formatted_course uniquely identify rosters/sections (which is no longer recommended). This is the only roster identifier supported pre-2.5.0.
  2. formattedCourse and termCode - Will yield unpredictable results unless  v_external_faculty_course and v_external_faculty_course_roster uniquely identify rosters/sections using formatted_course and term_code pairs, which is still required even as of 2.5.0 in order to support legacy roster selection behavior in the Early Alert portlet UI. This combination not supported pre-2.5.0.
  3. sectionCode - The recommended approach for 2.5.0, assuming v_external_faculty_course and v_external_faculty_course_roster uniquely identify rosters/sections with section_code (which they should). Not supported pre-2.5.0.

To target an enrollment within a roster/section, specify one of:

  1. studentSchoolId - Should map to v_external_faculty_course_roster.school_id. This is the only student identifier supported pre-2.5.0.
  2. studentUserName - Will be effectively resolved to a studentSchoolId using v_external_person and person. Ignored if studentSchoolId is present. Not supported pre-2.5.0.

Invocation - Targeting Default Portlet

Here is an example server-to-server URL that will generate a temporarily authorized URL pointing to the user's default SSP Platform view because the view parameter is not specified.

Example SSO URL

Invocation - URL Protocol

Should be https for production, though you can use http (non-SSL) on a local environment for development. The SSO will reject http requests unless the is set tofalse.

Invocation - Parameter Definitions


Only currently supported value is, referring to the Early Alert creation form. If this query parameter is not specified or does not equal, the resulting temporarily authorized URL will send the user to her default SSP view.


This is the username of the end user to be logged in to SSP when redirected to the resulting temporarily authorized URL. Should correspond to to v_external_person.username and person.username in the SSP database. If targeting the Early Alert form, this value will be resolved to a Platform user account which must in some way (either via Platform directory attribute or SSP database content) be associated with a schoolId which matches v_external_faculty_course.faculty_school_id and v_external_faculty_course_roster.faculty_school_id for the roster/roster enrollment being targeted.


New as of SSP 2.5.0.

This is the schoolId of the end user to be logged in to SSP. Should correspond to to v_external_person.school_id and person.school_id in the SSP database. If targeting the Early Alert form, this should also match v_external_faculty_course.faculty_school_id and v_external_faculty_course_roster.faculty_school_id for the roster/enrollment being targeted.

If using this field, it must be possible to look up SSP-Platform users by their schoolId attribute using whatever directory services have been integrated.

If username is present, this field is ignored.

If this field is present and not obscured by usernametoken will be validated against this field rather than username.


This is a partial or complete identifier of a roster/section for which the authenticated user is a faculty member of record, and in which the targeted student (studentSchoolId or studentUserName) is enrolled. As such, this field is only relevant if, but in that case, if this field is sent, its value must match v_external_faculty_course.formatted_course and v_external_faculty_course_roster.formatted_course.

Will be 'and-ed' with termCode and sectionCode when looking up the targeted roster/roster enrollment if either or both of those fields are also present. When sent by itself (i.e. without sectionCode and/or termCode), formattedCourse is an ambiguous roster identifier unless SSP external data has been configured to treat this as a unique roster/section identifier (as was traditionally done in very early 1.x deployments, but is no longer recommended). Otherwise sending this identifier by itself may result in unpredictable behavior.


New as of SSP 2.5.0.

This is the actual identifier for the roster being targeted for an Early Alert. As such, this field is only relevant if If sent, this field's value must match v_external_faculty_course.section_code and v_external_faculty_course_roster.section_code.

Will be 'and-ed' with formattedCourse and termCode when looking up the targeted roster/roster enrollment if either or both of those fields are also present. But this field is sufficient to uniquely identify a roster when sent by itself. As such, as of 2.5.0, it is the preferred means for identifying the targeted roster via this protocol.


This is the identifier of the academic term in which the targeted roster/section is offered. Should correspond to v_external_term.codev_external_faculty_course.term_code, and v_external_faculty_course_roster.term_code.

When sent by itself (i.e. without formattedCourse and/or sectionCode, this identifier is a wholly ambiguous roster identifier and will be considered an error condition).

This field is usually only sent in combination with formattedCourse, in which case v_external_faculty_course and v_external_faculty_course_roster must uniquely identify rosters/sections using formatted_course and term_code pairs, which is still required even as of 2.5.0 in order to support legacy roster selection behavior in the Early Alert portlet UI (even if section_code also uniquely identifies rosters/sections).


This is the identifier of a student who is enrolled in the targeted roster/section. This value must match the school_id column in the v_external_faculty_course_roster view for the targeted roster/section, and it must also be consistent with values in v_external_person.school_id and person.school_id representing this student in the SSP database.

Only relevant if In that case, at least one of studentSchoolId and studentUserName is required as of 2.5.0. Prior to that, only studentSchoolId was required. If this field is present, studentUserName is ignored.


New as of SSP 2.5.0.

This is the identifier of a student who is enrolled in the specified roster/section. Will be resolved to a school_id using v_external_person and person, which will then effectively be treated the same way as studentSchoolId

Only relevant if In that case, at least one of studentSchoolId and studentUserName is required as of 2.5.0. Prior to that, only studentSchoolId was required. If studentSchoolId is present, this field is ignored.


This should be the requesting client's server timestamp in UTC time, formatted as yyyy-MM-dd'T'kk:mm:ss'Z' using Java SimpleDateFormat notation, e.g. 2013-08-26T16:44:03Z. Required if in SSP Platform's


This parameter is the most complex. It must be equal to the result of hashing (using the MD5 algorithm) the URL-decoded value of the username or schoolId parameter, the URL-decoded value of the timeStamp parameter if present, and the sharedSecret (from The SSO Servlet performs this computation on its own, then compares it's result with the token parameter passed by the client. This is a security measure intended to verify that the client system is authorized to use this service: any client that knows the secret is deemed to be authorized. If the values match, the SSO will be allowed.

If username is present on the request, its value will be validated against token and schoolId will be ignored.

Here is the Java code in SSP that calculates this hash:

MD5 Hashing Java Code
    private boolean validateToken(final String usernameOrSchoolId, final String timestamp, final String token) throws UnsupportedEncodingException, NoSuchAlgorithmException {
        final MessageDigest md = MessageDigest.getInstance("MD5");
        if(timeStamp != null){
        final byte[] hash = md.digest();
        final String md5 = new String(Hex.encode(hash));
        return md5.equals(token);

    // if username="foo", timestamp="2013-08-26T16:44:03Z" and token="monkey", the md5 string will be a62e92eec800a52cf6d4c7a6288f4209
MD5 Hashing ASP Code
     'converts string to UTF8 to ensure there are no non-ascii characters
     Function ConvertFromUTF8(sIn)
        Dim oIn: Set oIn = CreateObject("ADODB.Stream")
        oIn.CharSet = "WIndows-1252"
        oIn.WriteText sIn
        oIn.Position = 0
        oIn.CharSet = "UTF-8"
        ConvertFromUTF8 = oIn.ReadText
     End Function

     dim token
     token = hex_md5(ConvertFromUTF8("foo") & ConvertFromUTF8("2013-08-26T16:44:03Z") & ConvertFromUTF8("monkey"))

     'if username="foo", timestamp="2013-08-26T16:44:03Z" and token="monkey", the md5 string will be a62e92eec800a52cf6d4c7a6288f4209


On successful use of the SSO handshake component, the client system will receive a JSON response similar the following:

Successful SSO Response

Error responses will use HTTP-standard status codes and messages. Further details are rendered as JSON in the response body:

Possible SSO Error Responses
    HTTP 403 {"message":"The SSO handshake requires a secure connection  (SSL)","success":false} was turned  on, but the request was HTTP.

    HTTP 400 {"message":"One or more required inputs was not  specified","success":false}
       Missing input(s).
    # New as of SSP 2.5.0
    HTTP 400 {"message":"Timestamp parse failure","success":false}
       Timestamp param not in correct format
    # New as of SSP 2.5.0
    HTTP 400 {"message":"Missing or invalid end user identifier(s)","success":false}
       End user identifier/s not sent or did not resolve to a Platform account

    HTTP 403 {"message":"Not authorized","success":false}
       Token was invalid.
    HTTP 403 {"message":"SSO key not configured","success":false}
       Feature is disabled
    HTTP 403 {"message":"Timestamp out of range","success":false}
       Timestamp param was stale

    HTTP 500 {"message":"Authorization check error","success":false}
       System-level failure while handling request, usually during token or timestamp validation.

    # New as of SSP 2.5.0
    HTTP 500 {"message":"End user lookup error","success":false}
       System-level failure trying to resolve username or schoolId parameter to a Platform account

If, then, the client system redirects the user to the URL provided in this response, that user will be logged into SSP, taken to the Early Alert portlet, and arrive at a pre-populated submission screen like the following...


  • No labels