Onelogin Accessing Third Party Apps Using Session Via API Token issue

Question

I've successfully received an access token via --> https://developers.onelogin.com/api-docs/1/oauth20-tokens/generate-tokens

Anyone please explain me how to create-session-login-token and used it so when i access subdomain.onelogin.com its redirect me to dashboard insted of login screen

I already try to do that but some how create session login token not generate and when i access onelogin.com its always redirect me to login page.

Rich Rich · Accepted Answer · 2020-01-03T18:45:27

To skip the login screen and go straight to the portal you need a session cookie.

To obtain the session cookie you need to make 2 requests.

https://developers.onelogin.com/api-docs/1/login-page/create-session-login-token

Using the access_token you have obtained you will make a server side request using the username, password and your OneLogin subdomain this will return a session_token.

You need to ensure that you include the Custom-Allowed-Origin-Header-1 header with its value set to the domain of your application.

curl -X POST \
  https://api.us.onelogin.com/api/1/login/auth \
  -H 'Authorization: bearer xxxxxxx-access-token-xxxxxxxx' \
  -H 'Content-Type: application/json' \
  -H 'Custom-Allowed-Origin-Header-1: https://example.com' \
  -d '{
    "username_or_email": "a-user-name",
    "password": "a-password",
    "subdomain": "your-onelogin-subdomain"
}'

https://developers.onelogin.com/api-docs/1/login-page/create-session-via-token

Then from your browser client side you will take the session_token from step 1 and make a CORS request to swap the session_token for a set of OneLogin session cookies.

It's important that this request is made from a browser that is currently on the same domain as specified in the Custom-Allowed-Origin-Header-1 from step 1.

function makeCors(session_token) {
   var xhr = new XMLHttpRequest();
   xhr.withCredentials = true;
   method = "POST";
   var url = "https://<your_subdomain>.onelogin.com/session_via_api_token";
   xhr.open(method, url, true);
   xhr.setRequestHeader("Content-Type", "application/json");
   body = {"session_token": session_token};
   xhr.send(JSON.stringify(body));
 };

Once these 2 steps have been completed you can directly access the OneLogin portal and will not be prompted to login again.

Onelogin Accessing Third Party Apps Using Session Via API Token issue

1 Answers