Accessing Third Party Apps After Creating A Session Via API Token

1
votes

I've scoured the api docs, as well as StackOverflow, and I've yet to find the answer to my question. And it is possible I'm misunderstanding how the system works.

Here's the scenario our client wants:

  1. User logs into our website
  2. At which point we authenticate the user in our system, and One Login via the api.
  3. After the user logs into our dashboard, they can click an link and be redirected to their third party analytics app due to the fact that I've created a new session with One Login.

Here are the steps I've completed.

  1. I've successfully received an access token via --> https://developers.onelogin.com/api-docs/1/oauth20-tokens/generate-tokens
  2. I've successfully used the access token to generate a session login token via --> https://developers.onelogin.com/api-docs/1/users/create-session-login-token
  3. I've successfully used the session login token to create a new session.

I'm receiving the proper cookies from One Login after making the create new session request, and - at that point - if I enter the URL onelogin.com/login, I am taken directly to the dashboard.

At this point I know I'm properly authenticated with One Login. However, I'm not sure how to directly access a third party app from a link on our website.

Thanks.

1
onelogin
Is there any chance you could can you tell me how you achieved step 3? - Stormcloud
Sure thing, @Stormcloud. FYI -- I've cached the session token in my system so that I can return it to the template. Anyway, in the Create Session VIA API Token docs there is Sample Request form. I've physically had to submit that form to get OL to send me the proper cookies. I tried submitting it via AJAX, but it always returned a CORS error of some type. Give that a try. - Michael Spangler
Thanks for the update. I've been trying the AJAX route (it's for a headless system) and it's been consistently failing. Time to try something new! - Stormcloud
If you want to do CORS, there's a specific CORS-related header you need to pass in to the create token call. Basically OL blocks CORS calls to the create session endpoint unless you specifically tell it to allow your domain(s) developers.onelogin.com/api-docs/1/users/… - Custom-Allowed-Origin-Header-1 - John Offenhartz

1 Answers

2
votes

Two ways:

If the app supports SP-initiated SAML, just navigate the user to the application and it'll do the whole SAML flow- App redirects to OneLogin - OL authenticates user (because you have a session) --- redirects SAML to app

Use the launch endpoint - You can create a URL to an app by using this format: https://app.onelogin.com/launch/{app-id}. For example, you can provide a link to an app like this:

<a href="https://app.onelogin.com/launch/123456">Time Reporting</a>

Details on that endpoint can be found here: https://developers.onelogin.com/api-docs/1/embed-apps/get-apps-to-embed-for-a-user

Take note that you're probably going to want to use the optional flag that makes sure to redirect to your login page, not OL's if you've built a login facade.