Virtual Capture Single Sign On

This technical guide describes the mechanism that allows seamless navigation between customers’ online banking applications and the Temenos Lifecycle Management Suite Virtual Capture application (Virtual Capture). The Single Sign-on (SSO) process permits an online banking end user to begin a new application, bypassing the standard Virtual Capture login page.

SSO Process
Security
GET Specifications
POST Specifications
Authentication Token Expiration
Authentication Failure

SSO Process

The online banking end-user must click a link, tab, button, etc., to launch Virtual Capture. The actual implementation (link, button, new window, iframe, etc.) is decided and implemented by the customer, and its provider of the online banking application.
The online banking application sends an HTTP GET via their server to Virtual Capture.
The GET must contain specific fields and values so that Virtual Capture can verify the request.
After Virtual Capture successfully verifies the request, the banking application receives an encrypted token.
The token is sent to virtual capture by the end user’s browser via an HTTP POST.
When the token is verified, the end user is presented with the Products page to begin a new application.

Reference the following diagram for an overview of the SSO Process:

Security

The SSO Process uses two levels of security to prevent unauthorized access to Virtual Capture.

SSL

The SSO request to Virtual Capture must be transmitted using SSL (https) to prevent request eavesdropping and tampering.

User Credentials

The SSO request to Virtual Capture must contain a valid username and password of a Lifecycle Management Suite user. This gives the customer control over which credentials are used for SSO. The same password policies are in place for the SSO request as any other Lifecycle Management Suite user. The customer also has the flexibility to shut down SSO access by simply deactivating this user in the Lifecycle Management Suite.

It is recommended that system administrators create a separate user in the Lifecycle Management Suite to perform Virtual Capture SSO requests. The following list includes recommendations for the settings to assign to the SSO user:

Set the Authentication Method for the user to System and assign a username and password.
Ensure that the Force password change on next login field is disabled.
Activate the Password never expires field.
Ensure that the user does not have any permissions set within the Permissions tab.

Token

The token generated by Virtual Capture is encrypted and does not contain any user information. The user information once saved is not passed back to the browser or saved within the token. If any of the user information needs to be changed, a new token would need to be generated.

GET Specifications

This section outlines the specific requirements for the HTTP GET to use SSO correctly. The expectation is that this request is made on the online banking applications server as to not expose sensitive data to network traffic.

Location

The SSO URL is a static URL, but it varies between customers. The Virtual Capture application exists as a virtual directory under a website, both of which are defined by the customer. For example, the website is “www.MyFI.org” and the virtual directory is “Virtual Capture.” In this scenario, the SSO URL is: https://www.MyFI.org/VirtualCapture/Login/GetLoginToken.

Query String Fields

The following table defines all fields supported in the HTTP GET for SSO:

Field Name

Description

PersonNumber

This field is the person number which identifies the online banking end user in the core system.

Person Number is typically used by banking core systems.

AccountNumber

This field is the account number which identifies the online banking end user in the core system.

Account (Member) Number is typically used by credit union core systems.

TIN

This field is the Tax Identification Number which identifies the online banking end user.

The TIN is typically the SSN for a person and an EIN for an organization.

Username

This field is the username for the third party application created by the customer through the Lifecycle Management Suite module.

Username is a required field.

Password

This field is the password for the third party application created by the customer through the Lifecycle Management Suite module.

Password is a required field.

At least one of the fields identifying the end user is required. A banking core system typically sends PersonNumber and not AccountNumber. A credit union core system typically sends AccountNumber and not PersonNumber.

This is an example of a complete GET Request URL:

https://www.MyFI.org/VirtualCapture/Login/GetLoginToken?UserName=myuser
&Password=mypassword&AccountNumber=myAccountNumber

This is an example of an Encrypted Token generated by Virtual Capture:

YO9A56MvKGgLdpSxh6XfBZAxVTADlkqEDBWecaOCHowBP4egJFBI0fT2UI/Ey9Ep

Response

The response is JSON data containing the needed information.

{
"AuthToken": “YO9A56MvKGgLdpSxh6XfBZAxVTADlkqEDBWecaOCHowBP4egJFBI0fT2UI/Ey9Ep”,
"Result": true,
"Messages": [],
"ExceptionId": 0,
"RequiresOverride": false
}

POST Specifications

This section outlines the specific requirements for the form POST after the encrypted token is returned.

Location

The SSO URL is a static URL, but it varies from customer to customer. The Virtual Capture application exists as a virtual directory under a website, both of which are defined by the customer. For example, the website is “www.MyFI.org” and the virtual directory is “Virtual Capture.” In this scenario, the SSO URL is: https://www.MyFI.org/VirtualCapture/Login/SSO.

Form Fields

Before the HTTP POST takes place, the encrypted token needs to be stored in a form field called “Data” as either JSON or string.

The following table defines all the Form fields that SSO can accept:

Field Name	Description
Data	Encrypted token received from the GetLoginToken method. This value must be in JSON format. For example: { "AuthToken": "YO9A56MvKGgLdpSxh6XfBZAxVTADlkqEDBWecaOCHowBP4egJFBI0fT2UI/Ey9Ep" }
RedirectURL	This field is the default URL where the financial institution wants Virtual Capture to redirect to after a successful single sign-on. The possible values are as follows: Products: Redirects to Product selection page. This is the default location if RedirectURL is not supplied. ListApplication: Redirect to current active applications for the applicant.
ProductCategory	This field is the Product Category that is loaded if Virtual Capture is configured to redirect to the Products URL. If a value for this field is not supplied, Virtual Capture redirects to the first Product Category.

To navigate a user to the product selection page, a sample request would be: https://www.MyFI.org/VirtualCapture/Login/SSO.

Authentication Token Expiration

A token expires 15 minutes after it is generated. If an expired token is used to enter Virtual Capture, no error or feedback is given. However, the user is not authenticated and treated as a guest.

Authentication Failure

This section details what occurs if authentication fails.

Member Experience

Failure to authenticate the member results in Virtual Capture returning an error (JSON string). The financial Institution can handle the error and take appropriate action. The following is an example of an authentication error:

{
"AuthToken": "",
"Result": false,
  "Messages": [{
    "Type": 0,
    "Text": "Invalid username or password",
    "Code": "",
    "IsUserFriendly": false
}],
"ExceptionId": 0,
  "RequiresOverride": false
}

Tracking

On All Authentication failures, a record is created in the error log.