On Wed, Feb 09, 2005 at 08:14:32PM -0000, Babu Kopparam wrote:
I have provided single sign on for multiple web applications using domain
cookies.
This works fine.
Now there is a requirement that, one particula link opens up a MS Excel
client. This client will contact multiple services (web resources) spanned
across multiple web applications.
As far as i know, i can't use cookies in the Excel.
Can some one help me in providing a single sign on solution for such a
situation.
Can you pass information to Excel dynamically that it would use in its
web requests? If so, you might consider a token scheme. When a user needs
to use the Excel link, you could
- devise a strongly random token (strongly random unique string ala
J2EE JSESSIONID, or unique ID + strongly random component)
- register information about that token with your SSO directory/system
- pass the random token via the link to Excel
- Excel would include the token in its requests, perhaps as a URL argument
- the web services contacted by Excel would extract the token, contact the
central SSO directory to validate the token & make appropriate authorization
decisions
Depending on your environment, the "tokens" could be the same values as the
SSO cookies your client already possesses -- the main question here is whether
this would pose any security risks, and without knowing much about how Excel
handles data (would the info be saved "invisibly" in a worksheet), or how your
network is configured, that's hard to say. If your dynamic links to Excel
I wouldn't give up on your SSO cookies, though, especially if your users are
(stuck) using Internet Explorer as the regular web client -- I would expect
that a combination of zone trust settings for your site and a little Visual
Basic for Applications code would allow Excel to make http/https requests with
the same authorization and cookie information that IE uses.
Some quick searching turns up promising pages on Win32 routines like
InternetGetCookie that can be used within VBA. Surely if VBA can obtain
the cookies from IE, it can make requests with the same auth/cookie credentials
that IE possesses. If so, you're all set.
-Peter
