NetCommunity 5.5 introduced a built-in Single Sign On model that you can use to authenticate requests coming in from other systems against a NetCommunity user account. If you know the user's NetCommunity username you can fly the user into the site, authenticating a new session for that user.
 
The model uses the concept of a secret key known only to the NetCommunity web site and the calling system. The key is encrypted onto the url with some additional information, including a timer value that sets the number of seconds for which the url will be accepted from the time it was created.
 
To setup a calling system, you create a new secret key in the System Options page:
 
 
  • Description: Anything you like that helps you keep track of this entry
  • Shared Key: A secret key that only you and the incoming system know. This is any string value. A long combination of letters and numbers is a good bet.
  • Querystring Parameter names. These are the variable names of the 3 parameters that the other system will be passing in on the URL for the following values
    • Username - plain text username
    • Time - epochtime when the Url was created (the time in number of seconds since Jan 1, 1970)
    • MD5 Hash - MD5 hash of the concatention of Secret key, Username, IP address, and epochseconds
  • Expiration - number of seconds after the Time value to expire the Url
  • Include IP - check this box if the hash contains the known caller's IP address
Once a calling system is defined as above,  it is up to the caller to build a URL that matches this definition. If a secured page or login page in NetCommunity is hit with a valid Url the session will be created with the provided username.
The accompanying sample code, demonstrates how to create a valid SSO url for a calling system you've setup this way, in your System Options. To test this, define a system as above, create a page not viewable to the Everyone role.
 
Run the sample app which is a single web form:
 
 
Fill in the Url of your secured page, use a username that is in a role that does have view rights to the page, and specify your secret key. Click the Create Url Button to generate a Url. Click the Url to test it. The Url will expire based on the number of seconds you defined for this calling system.