Freestone Integration: Single Sign-on

In the integration between Freestone and NetForum, the user record is owned and managed on the NetForum platform. The integration uses Single Sign-on (SSO) to make sure that updates to the user record are tracked accurately whether the customer logs in from the Freestone or NetForum eWeb interface.

SSO means that a user has a shared identity across both applications can log in to both applications by logging into either site. For example, if the user logs into NetForum eWeb, and then navigates to Freestone, they do not need to log in to Freestone separately.

SSO begins when a user lands on the Freestone portal to perform an action that requires them to sign in to the application. This could be purchasing a course, viewing existing purchases, or launching content.

SSO authenticates the user using a NetForum eWeb login and returns the user immediately to the Freestone portal. This is accomplished using a web redirect to the eWeb site and by the xWeb AuthenticateLdap method.

Authentication Process

Freestone/eWeb users log in to the NetForum eWeb site, using their NetForum credentials. The authentication is the same with the Freestone integration, whether they enter from the Freestone portal or the eWeb site. When the Freestone portal is styled to mimic the eWeb site, the end user log-in experience should be seamless from either website.

The SSO includes the following validation for a user's credentials:

1. A user can browse to the organization's Freestone portal. If the organization has customized their Freestone portal with the NetForum integration, the user is automatically redirected to the NetForum eWeb login page.
2. The user enters their NetForum eWeb credentials (user ID and password).
   • If the validation succeeds, NetForum returns a token to Freestone that can be used by subsequent actions of the Freestone application (for example, purchasing a course).
   • If the validation fails, the NetForum waits for the user to sign in successfully before sending the token to the Freestone application.
   • If the token expires before a successful sign-in or if the token cannot be validated, the authorization process ends with an error message that prompts the user to contact Customer Support. This is unlikely to occur.
3. If this is the first time that the user has signed in from the Freestone portal, the Freestone application creates a Freestone registration for them, using the same user ID and password as the eWeb site. Subsequent sign-ins by the user update the user’s identity in Freestone from the information in NetForum.
4. A valid token can be used as long as the session is active. If the session is closed, times out, or if the user signs out, a new sign in and token are required.