Protech Authentication

Introduction

ProtechAuth allows you to integrate a SSO functionality with Protech's Web Portal and CRM4M database through their authentication web services. This modules uses Protech defined Unified Login Scenario 2 – User logins into Drupal and authenticates against Protech CRM4M.

Installation

ProtechAuth can be installed like any other Drupal module -- place it in the modules directory for your site and enable it.

Requirements

* PHP SOAP Libraries
* PHP 5.2 or higher

* Protech WDSL authentication web service URL
* Protech authentication security password

Configuration

See the module configuration settings page at admin/settings/protech. You can enter your WSDL authentication webservice url, authentication security password, match a security group with a Drupal role (for example Administrator -> admin) and match a Membership Type with a Drupal role (for example Member => member).

Standard Drupal pages: Forgot Password, Create New Account, and user page can be overwritten in the configuration of the module.

uid 1 is always exempt from the SSO process and the configuration screens allow you to exempt others.

The returned TOKEN is set in a Session variable $_SESSION['TOKEN'] and will need to be appended to all Protech web portal links in order for the SSO process to be passed through.

Login Scenarios

* Case 1:
User 1 Login
User 1 (uid=1) enters login credentials. Credentials authenticate against Drupal login validation only. Does not call web service. If credentials are valid, user is login as a superuser in Drupal and not logged into Protech. If credentials are invalid, login fails.

On logout, the user is logout out of Drupal. No web services are called.

* Case 2
Member Login – has logged in before
Member enters login credentials and it calls the web service to authenticate user - AuthenticateUser(securityPassword, username, password). If user authenticates successfully, it sets the returned token as a session variable $_SESSION['TOKEN'], assigns the roles returned from Protech to the user (Security Group and Membership Type), sets the status=1, and updates id, email, and password.

If the login credentials fail to authenticate, it sets the Drupal user status to 0.

On logout, the user is logout out of Drupal, and the authentication web service is called - DeleteUserSession(securityPassword, token) is called and the user is logged out of Protech.

* Case 3
Member Login – first time login
Member enters login credentials and it calls the web service to authenticate user - AuthenticateUser(securityPassword, username, password). If user authenticates successfully, it sets the returned token as a session variable $_SESSION['TOKEN'], assigns the roles returned from Protech to the user (Security Group and Membership Type), sets the status=1, and creates a user in Drupal with the id, email, and password.

On logout, the user is logout out of Drupal, and the authentication web service is called - DeleteUserSession(securityPassword, token) is called and the user is logged out of Protech.

* Case 4
Non Member Login – No longer a member (inactive) or set as a non member
Non member enters login credentials, and it calls the web service to authenticate user - AuthenticateUser(securityPassword, username, password). If the login credentials fail to authenticate through the web service, it sets the Drupal user status to 0 and does not log in user to either system.

If login credentials authenticate, but the Membership Type/Security Group roles are different or removed, it updates the role of the Drupal user during authentication with new roles.

On logout, the user is logout out of Drupal, and the authentication web service is called - DeleteUserSession(securityPassword, token) is called and the user is logged out of Protech.

Limitations

* This has been tested with Protech CRM4M and implements their defined Unified Login Scenario 2. The functions from Protech CRM4M authentication web services that are used are AuthenticateUser(securityPassword, username, password) and DeleteUserSession(securityPassword, token).
* This allows for one security group to be matched for each Drupal role. These are set in the configuration settings for the module.