Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 26: Single Sign-On in SharePoint Portal Server 2003 719
Works,” the preceding code corresponds to steps 1 through 5. In addition to this
code, you have to implement steps 6 through 8.
Your code for interacting with the enterprise application such as submitting
credentials and retrieving information will be different depending on the type of
application you are accessing. You need to consider that in an enterprise environment,
where a user interacts with many systems and applications, it is likely that the
environment does not maintain the user context through multiple processes, products,
and computers. This user context is crucial to provide single sign-on capabilities
because it is necessary to verify who initiated the original request. To overcome
this problem, SharePoint Portal Server provides ability to use a Single Sign-On (SSO)
ticket (not a Kerberos ticket). An SSO ticket is an encrypted access token that can be
used to get the credentials that correspond to the user who made the original
request. Also, in the enterprise environment you might consider using Microsoft Biz-
Talk Server as a transformation engine for the authentication requests, as well as
requests for data, between your Web Part and a format that is understood by the
enterprise application.
An example of such enterprise application integration (EAI) infrastructure is
shown in Figure 26-2. In this scenario, a Web Part gets the information from a line
of business (LOB) back-end application using BizTalk Server 2004. The LOB application
requires authentication. In this example, we will assume that the enterprise
application definition for the LOB application has already been created, and the user
credentials have been stored in the SSO database.
The authentication process shown in Figure 26-2 consists of several steps, as
follows:
1. The Web Part calls Microsoft.SharePoint.Portal.SingleSignon.Credentials
.ReserveCredentialTicket() with the user. This method reserves a credential
ticket for the user and then returns an encrypted access token (SSO ticket) to
the calling Web Part.
2. The Web Part passes the SSO ticket to the BizTalk Server 2004 native SOAP
adapter by calling a Web service that runs on BizTalk Server. The SSO ticket is
passed within the header of the SOAP request. When the SOAP adapter receives
a request containing an SSO ticket, the ticket is stored as the SSO Ticket property
in the context property of the BizTalk message. For details on configuring
BizTalk 2004 SOAP adapter for integration with SharePoint Portal Server single
sign-on, refer to http://msdn.microsoft.com/library/default.asp?url=/library/en-us
/operations/htm/ebiz_ops_adapt_file_eixk.asp.
3. BizTalk passes the SSO ticket to the adapter for the LOB application that has
the ability to call into SSO to redeem user’s credentials using an SSO ticket.
The LOB adapter calls Microsoft.SharePoint.Portal.SingleSignon.Credentials
.GetCredentialsUsingTicket().method with the encrypted SSO ticket along with
the enterprise application definition name to retrieve the security credentials