Setting up the BSS Mechanism

On BSS, navigate to: BSS > Setup > Administration > System Options > Storefront Login Settings (as explained in this Documentation)

Click on "Settings (Custom)".Image Removed

Image Added

On the following page, please provide a name to the Instance Name text  text field.  Image Removed

Image Added

• Choose one of the two hash Algorithms (MD5 or SHA256), from the drop-down menu, for the encryption.

• Paste your [Hash Key]

   to the 

   to the Hash Key text field.

• Then click on the "Save" button.

Click on "Activate" from the top bar and the token-based authentication is ready to be used.Image Removed

Image Added

Updating the Hash Key via API

Since the Hash Key value is an essential part of the encrypted token and because the Token-Based SSO implementation on our end could not provide a timely refresh of the Hash Key value, we have implemented an expiration method via the use of API. Therefore, as a Public API V.3 user, you can update the Token-Based SSO Hash Key value with the use of the PATCH /api/ExternalAuthentications/providerinstances/{instanceId}/settings endpoint based on the instance ID. With this method, you can create a repetitive (daily, for example) automation of refreshing the Hash Key value of the token, to generate a new value of the Hash Key everyday every day and accordingly have the tokens of the previous days expire. As  As a result, with this update (via API) method, you achieve enhanced security by automatically refreshing Hash Values while ensuring timely expiration.

Client-Side Parametrization for Token-Based SSO

The following notes are a systems' communication example as well as an implementation guide for the client-side infrastructure so that the single sign-on between your main web site and your Storefront can function without issues. 

Url Parameters:

• token: Is a required parameter for user authentication.

• refurl: Is an optional parameter for redirecting users after their login.

The link from your portal to your Storefront should be of the form form https://{SYSTEM_URL}/externalauth/CSTM_TOKEN/{INSTANCE_ID}/?token={Algorithm}({Email/Username}{HashKey}) where the token should be encrypted using either the MD5 algorithm MD5(Email/Username+Hash_Key) or the SHA256 algorithm SHA256(Email/Username+HashKey).

• Email/Username: It must be the email of the Storefront user you have in BSS.

• HashKey: A value you will decide.

What you should implement is a mechanism through which you will collect your customers' emails and use it for creating the token and redirecting the customer to your Storefront.