1

I need to establish SSO from our SharePoint 2010 sites to various third party web applications. these applications do not authenticate against the same directory servers as SharePoint does. I expect that I'll use the Secure Store Service for this and I've found plenty of documentation on how to set it up, but little on how to use the data to sign a user into an external web site.

My first application that I'll be bringing into SSO is an in-house created ASP application that authenticates against an LDAP separate from the one that my SharePoint uses.

Can anyone point me in the direction of some code that will help me do this or is it possible to do without code?

  • What have you tried? Please provide more details on what you have tried before asking for help. – Sam Sussman Feb 1 '14 at 2:20
  • Your question is unclear. Do you want a user to get logged in into SharePoint, then navigate to another external app and be authenticated automatically? If so, with his credentials or some other? – MdMazzotti Feb 1 '14 at 8:40
  • To clarify, I'm looking for a solution where the user logs into the main sharepoint site and then can navigate to other sites without having to enter credentials after the first time when the credentials get inserted to the secure store service. – Eric Carlson Feb 3 '14 at 14:38
2

if you plane to use the Secure Store Service as an SSO solution you can access to the sorted information programmatically is 3 simple steps (after you have created sss application)

You can Access to the secure store service programmatically

1 - Retrieve the Central Administration Site

public static SPSite GetCentralAdminSite()
{
    SPAdministrationWebApplication adminWebApp = SPAdministrationWebApplication.Local;
    if (adminWebApp == null)
    {
        throw new InvalidProgramException("Unable to get the admin web app");
    }

    SPSite adminSite = null;
    Uri adminSiteUri = adminWebApp.GetResponseUri(SPUrlZone.Default);
    if (adminSiteUri != null)
    {
        adminSite = adminWebApp.Sites[adminSiteUri.AbsoluteUri];
    }
    else
    {
        throw new InvalidProgramException("Unable to get Central Admin Site.");
    }

    return adminSite;
}

2 - Decrypt the secure string

private static string GetStringFromSecureString(SecureString secStr)
{
    if (secStr != null)
    {
        IntPtr pPlainText = IntPtr.Zero;
        try
        {
            pPlainText = Marshal.SecureStringToBSTR(secStr);
            return Marshal.PtrToStringBSTR(pPlainText);
        }
        finally
        {
            if (pPlainText != IntPtr.Zero)
            {
                Marshal.FreeBSTR(pPlainText);
            }
        }
    }

    return null;
}

3 - Now we can retrieve all credentials stored in the Secure Store Application

public static Dictionary<string, string> GetCredentialsFromSecureApp(string applicationId)
{

    var credentialMap = new Dictionary<string, string>();

    // Get the default Secure Store Service provider.
    ISecureStoreProvider provider = SecureStoreProviderFactory.Create();
    if (provider == null)
    {
        throw new InvalidOperationException("Unable to get an ISecureStoreProvider");
    }

    var providerContext = provider as ISecureStoreServiceContext;
    if (providerContext != null)
        providerContext.Context = SPServiceContext.GetContext(GetCentralAdminSite());

    var secureStoreProvider = new SecureStoreProvider
                              {
                                  Context = SPServiceContext.GetContext(GetCentralAdminSite())
                              };

    using (var credentials = secureStoreProvider.GetCredentials(applicationId))
    {
        var fields = secureStoreProvider.GetTargetApplicationFields(applicationId);
        for (int i = 0; i < fields.Count; i++)
        {
            var field = fields[i];
            var credential = credentials[i];

            var decryptedCredential = GetStringFromSecureString(credential.Credential);

            credentialMap.Add(field.Name, decryptedCredential);
        }

    }

    return credentialMap;
}

Add this references to your project :

using System.Runtime.InteropServices;
using Microsoft.BusinessData.Infrastructure.SecureStore;
using Microsoft.Office.SecureStoreService.Server;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Administration;

To do a simple test, I created a console application with this code:

static void Main(string[] args)
{
    Dictionary<string, string> dic = GetCredentialsFromSecureApp("Secure App ID");

    foreach (var VARIABLE in dic)
    {
        Console.WriteLine(VARIABLE.Key +" : "+ VARIABLE.Value);
    }
    Console.ReadKey();
}

enter image description here

  • I don't really think this is what the OP asked for. He's looking for a way to authenticate in SSO from SharePoint to external app, that is a user first logs in into SharePoint, then open the external app and he's already authenticated. Nothing to do with programmatic access. At least, this is what I understand from his question – MdMazzotti Feb 1 '14 at 8:34
  • After having entered credentials into the secure store once, the credential are available to be sent to the third party application being logged into. If I have to use code to retrieve the credentials, then the above code from Nizar Grindi will be a big help in accomplishing that. However, it seems like there ought to be an easier way to accomplish this. Isn't there something in SharePoint out of the box that will do what I'm looking for? – Eric Carlson Feb 3 '14 at 14:56
1

Sounds more like a general authentication/active directory challenge rather than SharePoint specific.

Have you looked into using claims and active directory federation services in order to federate different identity providers?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.