← Back to plugin index

SSO Ticket Request Authentication
Description
Extracts an SSO ticket from a request to authenticate single requests.

SSO tickets are not remembered and can be used for multiple requests.

Type name
SsoTicketRequestAuthentication
Class
com.airlock.iam.common.application.configuration.credential.SsoTicketRequestAuthenticationConfig
May be used by
Fallback Request Authentication Adminapp REST API Configuration Session-less REST Endpoints Transaction Approval
Properties
SSO Ticket Extractor (ssoTicketExtractor)
Description
Determines where the SSO ticket is to be extracted from.
Attributes
Plugin-Link
Mandatory
Assignable plugins
Loginapp UI SSO Ticket Extractor OIDC SSO Ticket Login Hint Extractor SSO Cookie Ticket Extractor SSO Header Ticket Extractor
Ticket Decoder (ticketDecoder)
Description

The ticket decoder plugin used to decode the SSO ticket.

Security note: If tickets are transported via the web browser (in the URL), they need to be protected. Make sure to use an appropriate ticket decoder securing the ticket (e.g. digitally signed and/or encrypted)!

Attributes
Plugin-Link
Mandatory
Assignable plugins
AES256 Decryption Ticket Decoder Esp Sign Ticket Decoder JWT Ticket Decoder OAuth 2.0 Access Token Ticket Decoder Plain Base64 Ticket Decoder Plain Ticket Decoder RSA Sign Ticket Decoder
Context Data Extractors (contextDataExtractors)
Description
List of ticket context data extractors that extract custom data from the ticket.
Attributes
Plugin-List
Optional
Assignable plugins
SSO Ticket Context Data Extractor
Username Key (usernameKey)
Description
The ticket key containing the username.
Attributes
String
Optional
Default value
username
Provided Username Key (providedUsernameKey)
Description

The ticket key containing the provided username, which is used for logging and possibly displayed.

This is not combinable with Username Transformation. If the ticket does not contain a provided username, the value from "Username Key" is used.

Attributes
String
Optional
Roles Key (rolesKey)
Description
The ticket key containing the user's roles. If not configured, no roles are extracted from the ticket.
Attributes
String
Optional
Example
roles
User Store (userStore)
Description
If configured, the user is loaded from local persistence and checked for validity. Authentication fails if the user is not found or is invalid. If no user store is configured, no persistency look-up takes place and the authentication is performed on data contained within the credential only.
Attributes
Plugin-Link
Optional
Assignable plugins
Active Directory Connector Custom User Persister-based User Store Provider Database User Store Extended User Persister-based User Store Provider LDAP Connector User Persister-based User Store
Username Transformation (usernameTransformers)
Description
Transforms the provided username from the credential to a technical user ID.
Attributes
Plugin-List
Optional
Assignable plugins
Airlock 2FA Username Transformer Context Data Username Transformer Identity Username Transformer Lowercase Transformer Primary Key Lookup Regex Username Transformer Template-based Username Transformer Token Data Username Transformer Uppercase Transformer
Static Roles (staticRoles)
Description
Static list of roles granted to the authenticated user.
Attributes
String-List
Optional
Roles Blocklist (rolesBlocklist)
Description
List of role names that won't be granted to the authenticated user. The block list is also applied to persistent roles (if available).
Attributes
String-List
Optional
YAML Template (with default values) 

type: SsoTicketRequestAuthentication
id: SsoTicketRequestAuthentication-xxxxxx
displayName: 
comment: 
properties:
  contextDataExtractors:
  providedUsernameKey:
  rolesBlocklist:
  rolesKey:
  ssoTicketExtractor:
  staticRoles:
  ticketDecoder:
  userStore:
  usernameKey: username
  usernameTransformers: