Background information
You can integrate your single sign-on (SSO) system with Dataphin. This allows users to log on to Dataphin through your SSO system. For the integration to work, your SSO application sets a ticket in a cookie, which must be on the same domain as the Dataphin system. This process enables ticket authentication, logon redirection, logoff, and account information retrieval.
After you switch to the new logon system, the original logon portal is disabled, and you can no longer access any accounts through the old system.
After the switch, you can only log on using your SSO system. Confirm that your new system provides accounts that correspond to the O&M administrator and super administrator roles. These accounts are needed for daily Dataphin O&M.
Provide a mapping that links each old account to its new account ID for logon.
Confirm that all old accounts can be added to the new logon system and can be used to log on. For example, some external accounts might not be compatible with an internal employee system.
The following time series chart shows the authentication request flow. The cookie must be on the same domain or root domain as the Dataphin application.
Required capabilities
Your SSO system must provide the following features.
After you configure these features, contact a Dataphin O&M engineer.
API specification
Request method: GET
Content type: Content-Type:application/json;charset=UTF-8
The URI of the request and the response format are described for each API. The default URI of the request is used, but it is configurable.
The default cookie name is DPN_SSO_TICKET and is configurable.
If the response returns `success: false`, provide a detailed explanation in the `message` field to help with troubleshooting.
1. Ticket (cookie) authentication API
Description: This API provides ticket authentication. The default URI of the request is /cookie/validCookie?ticket={ticket}.
2. Logon authentication API with target-url redirection
http://127.0.0.1:8080?target-uri=http://dataphin.com
If authentication has expired, Dataphin appends the current page's URL to the logon authentication URL. This allows the user to return to the original page after successfully logging on.
3. Logoff API
This API logs off the user from the platform. The `redirect` parameter is the logoff redirection address.
Option 1: Call this API to invalidate the cookie. The `redirect` field returns your authentication logon page. If the API cannot invalidate the cookie, use the redirection URL to clear the cookie before navigating to the specified page.
Option 2: Call this API. The `redirect` field returns the logoff URL of your user system. Dataphin redirects to this URL to complete the logoff process.
The default URI of the request is /user/logout?ticket={ticket}. The response format and definition are as follows.
{
"success":true,
"data":{
"redirect":"http://127.0.0.1:8080"
},
"message":""
}4. User details API
This API is used for user information sync. It is reserved for future use and is not currently used by the application.
The default URI of the request is /user/getUser?userId={userId}. The response format and definition are as follows.
{
"success":true,
"data":{
"userId":"1",
"parentUserId":"0",
"accountName":"account1",
"displayName":"dataphin1",
"realName":"Zhang 1",
"nickName":"Zhang 1 Feng",
"email":"1@alibaba.com",
"mobilePhone":"12300000001"
},
"message":null
}5. User details list API
This API is used for user information sync and must be implemented.
Full sync
The default URI of the request is
/user/getAllUser. The response format and definition are as follows.{ "success":true, "data":[ { "userId":"1", "parentUserId":"0", "accountName":"account1", "displayName":"dataphin1", "realName":"Zhang 1", "nickName":"Zhang 1 Feng", "email":"1@alibaba.com", "mobilePhone":"12300000001" }, { "userId":"2", "parentUserId":"0", "accountName":"account2", "displayName":"dataphin2", "realName":"Zhang 2", "nickName":"Zhang 2 Feng", "email":"2@alibaba.com", "mobilePhone":"12300000002" } ], "message":null }Paging
The default URI of the request is
/user/getAllUser?pageNo={page_number}&pageSize={items_per_page}. The response format is the same as for the full sync. The process stops when the `data` list is empty.
6. Logon configuration and account mapping
After development, provide the logon configuration and account mapping to switch to the new logon system.
Logon configuration
# The following are default values. Modify them if you have made changes. dataphin.thirdpart.sso.endpoint=http://127.0.0.1:8080 dataphin.thirdpart.sso.cookie.name=DPN_SSO_TICKET dataphin.thirdpart.sso.cookie.validUrl=/cookie/validCookie?ticket={ticket} dataphin.thirdpart.sso.user.logoutUrl=/user/logout?ticket={ticket} dataphin.thirdpart.sso.user.getUserUrl=/user/getUser?userId={userId} dataphin.thirdpart.sso.user.getAllUserUrl=/user/getAllUser dataphin.thirdpart.sso.isCustomizeTargetUrl=falseAccount mapping
Old account user ID or Dataphin user ID
New logon system user ID
Example: SuperAdmin or 30000001
12345678
Example: SuperAdmin or 30000002
87654321
Verification after integration
Verify the logon feature. Confirm that you can log on to Dataphin through your SSO system and that user information displays correctly.
Verify user sync.
Go to Dataphin Management Hub > Member Management and click Sync Account System. The sync is successful if no error occurs and the synced users are displayed when you click Add Member.
Verify the logoff feature.
In Dataphin, click the profile picture in the upper-right corner and click Log Out. Confirm that you are redirected to your specified page and that the cookie is cleared as required.
To switch the SuperOps/SuperAdmin account to a different account in your logon system, contact a Dataphin O&M engineer.