Lambda Store SSO (OAuth)

This article introduces the basics behind the Lambda Store SSO (OAuth).

TOPICS

• Configurations
• Field Mappings
• Getting Started with Lambda Suite SSO (Token)
• Appendix A: Lambda SSO (Token)
• Appendix B: Country Codes
• Appendix C: Region Codes

---

Configurations

To enable Lambda Store SSO, we require the following information:

• Client ID
• Client Secret
• Client Scopes (i.e. openid profile email)
• Authorization Endpoint (e.g., https://git.net/oauth/authorize)
• Token Endpoint (e.g., https://git.net/oauth/token)
• User Info Endpoint (e.g., https://git.net.oauth.userinfo)

The URL for callback will be: <your Store URL./lambdasso/oauth2

(e.g., https://store.lambdasolutions.net/lambdasso/oauth2)

Back to TOPICS

---

Field Mappings

The following fields are valid in the JSON reply to create or update the new customer account:

Example Profile Response:

{
   "id": "user@email.com",
   "attributes": {
      "givenName": "First Name",
      "familyName": "Last Name",
      "email": "user@email.com"
    }
}

Back to TOPICS

---

Getting Started with Lambda Store SSO (Token)

The link from your application to the Lambda Store should look like either:

1. https://<store site>/lambdasso/index/index/ticket/<ticket>, or

2.  https://<store site>/lambdasso/?ticket=<ticket>

The parameter <ticket> is generated by your application. The Lambda Store will validate the <ticket> by sending the <ticket> and <secret> to validation endpoint.

e.g., GET https://<client server>/<validation endpoint>?ticket=<ticket>&secret=<secret>

Lambda Store SSO Settings

Provide the Lambda Store with both:

1.  Validation Endpoint URL

2.  Secret

Endpoint Validation Reply

The validation endpoint should return as a JSON reply.

Successful Endpoint JSON Reply

{
   "status": "OK',
   "user": {
      "email": "john.doe@example.com",
      "firstname": "John",
      "lastname": "Doe",
      "company": "Company",
      "address": {
         "street": [
            "Suite 200-110 West Hastings"
         ],
         "city": "Vancouver",
         "country_id": "CA",
         "region": "BC",
         "postcode": "V6B 1G8",
         "telephone": "+1.234.567.890"
      }
   }
}

• Email, firstname, and lastname are required.
• Email is a unique key for customers in the Lambda Suite.
• Company and address are optional.
• If address is set, then street, city, country_id, and telephone are required.
• Region and postcode could be optional or required, depending on store settings.
• Street is an array of strings, up to 2 lines.
• Country_id should be one of the country codes in Appendix A.
• Region: If there are region codes defined in Appendix B for the country_id, then region should be a value from either regioncode or regionname column. If there are no region codes defined for country_id, then it could be any string. 

Failed Endpoint JSON Reply

{
   "status": "INVALID_TICKET",
   "description": "Ticket not recognized"
}

• Status field should have value different than "OK".
• Description field is optional.

Back to TOPICS

---

Appendix A: Lambda SSO (Token)

Secret and Ticket Recommendations

• The Validation Endpoint URL must use HTTPS.
• The secret should not be part of the ticket.
• The ticket must only be valid for one ticket validation attempt. Whether or not validation was successful, Central Authentication Service (CAS) must then invalidate the ticket, causing all future validation attempts of that same ticket to fail. 
• CAS should expire an unvalidated ticket in a reasonable period of time after they are issued. If a service presents an expired ticket for validation, CAS must respond with a validation failure response.
• The validation response should include a descriptive message explaining why validation failed.
• The duration of a ticket should be 5 minutes or less. Local security and CAS usage considerations may determine the optimal lifespan of an unvalidated ticket. 
• The ticket must contain adequate secure random data so that a ticket is not guessable.
• The secret must contain adequate secure random data so that a secret is not guessable.
• The ticket and secret should be random. 

Back to TOPICS

---

Appendix B: Country Codes

Back to TOPICS

---

Appendix C: Region Codes

Back to TOPICS