This is for each user of the system. The instructions from the vendor are below (redacted):

Workflow

Below is the general outline of the workflow for token based SSO request.

1. User accesses a link on their domain that will start the process.
2. The AES Encrypted token is decrypted using the private key and the user is authenticated with the respective information.
3. Once validated, the user is allowed access to [WebURL].com.

Technical Specifications

1) [Company] will provide the endpoint for SSO access.

Sample URI - [WebURL].com/home?m=groupId&t=F9Xi9yt4a6QWiM+4e/1I0dKUcQX+rBMQgdOU9qdk5LAqhl6Ph7KgJNcjluD1bQL

Endpoint - [WebURL].com/home?

Query Parameters

• Group Id (m) – A unique Id to identify the Group and to get the user benefit details

• AES Encrypted token (t) - F9Xi9yt4a6QWiM+4e/1I0dKUcQX+rBMQgdOU9qdk5LAqhl6Ph7KgJNcjluD1bQLn

(Member ID||Current UTC Datetime)

2) The Vendor/Client will need to provide an AES encrypted token which includes the following information

Member Id - To fetch the member details

Current UTC Datetime (dd/MM/yyyy HH:mm:ss) - To restrict access to the link after 30 mins

The parameters to be separated by double pipe (||) symbol. For ex. 123456||08/11/2018 15:00:00

3) Private Key Creation

Concatenate Group Id with constant string “[WebURL].com”. For ex. If Group Id is GRP123, the sample string will be “GRP123||[WebURL].com”. Encode the string to create a base64 string and take the first 32 bytes. The 32 bytes will be used as private key for encryption.

-----

Sample AES Encryption Code in PHP

<?php

//Enter your code here, enjoy!

//initialization

$groupId = "3410";

$memberId = "00000000TEST";

$url = "www.weburl.com";

//Current UTC datetime

$date = new DateTime();

$date->setTimezone(new DateTimeZone('UTC'));

$utcDateTime = $date->format('d/m/Y H:i:s');

//Get plain text

$source = $memberId . '||' . $utcDateTime;

//UTF8 encode

$strPKey = $groupId . '||' . $url;

$encodedStr = mb_convert_encoding($strPKey, "UTF-8");

//Encode to base64 and create unicode array

$base64String = base64_encode($encodedStr);

$utf8Str = mb_convert_encoding($base64String, "UTF-8");

$unicodeArr = unpack("C*", $utf8Str);

//Plain Text

$clearBytes = mb_convert_encoding($source, "UTF-16LE");

//Key generation

$key = array_slice($unicodeArr, 0, 32);

$key = implode(array_map("chr", $key));

$iv = array_slice($unicodeArr, 0, 16);

$iv = implode(array_map("chr", $iv));

//Encrypt and encode to base64

$encryptedStr = openssl_encrypt($clearBytes, 'AES-256-CBC', $key,

OPENSSL_CIPHER_AES_128_CBC, $iv);

$encryptedContent = base64_encode($encryptedStr);

echo $encryptedContent;