Here's how remote authentication works:
- A reader tries to access your knowledge base.
- If they are not already authenticated, the reader is redirected to your specified remote authentication landing page URL.
- Your landing page authenticates the reader in your system.
- After authentication by your system, an API call is made to KnowledgeOwl's remote authentication token request endpoint. If you are utilizing readers and reader groups, that information is passed during this token request.
- Once the login token is received by your system, the reader is redirected to the KnowledgeOwl remote authentication endpoint with this single use token which completes the handshake and the reader gains access.
Before you enable remote authentication, you'll need three things:
- Appropriate permissions
- The URLs for login/logout of your remote authentication system
- An API key
Appropriate permission
You'll need to be logged in as an author who has one of these two permissions:
- The default Editor role
- A custom author role with the Update security settings permission
Remote authentication URLs
You'll need to know:
- The login URL for your remote authentication: the URL a reader should visit to enter their credentials
- The logout URL for your remote authentication: the URL a reader should be directed to once they've logged out
API Key
You'll also need an API key with GET permissions. Something like this will work:
Refer to API keys for full steps on creating a new API key.
Use a unique API key
We recommend creating a new API key restricted to GET calls for this type of authentication, and using this key only for this authentication.
Before you can set up the full authentication process, you'll need to enable remote authentication. To do so:
- Go to Security and access > Security settings.
- In the Authentication settings section, under Content authentication, select Remote authentication.
- If it won't disrupt current login processes, we also recommend setting the Unauthenticated access behavior to Redirect them to your remote auth login URL.
- Save your changes.
- Now go to Security and access > Single sign-on.
- Open the Remote authentication tab.
- Add the URL that readers should be directed to to login to your remote authentication system into the Remote login URL field.
- Add the URL that readers should be directed to once they've logged out of your knowledge base into the Remote logout URL field.
- Save your changes.
With remote authentication enabled, configure the calls and script to request access tokens and authenticate your readers.
Step 1: Request token
First, you'll need to hit the KnowledgeOwl API remotelogin
endpoint to request a token. Use the API key you generated previously to make this call. At minimum, you must pass in the knowledge base's project ID and the reader's username.
Copy your knowledge base ID from Security and access > Single sign-on > Remote authentication.
Here are the details on the API endpoint:
Endpoint URL
https://app.knowledgeowl.com/api/head/remotelogin.json
Parameters | Example | Required? |
---|---|---|
project_id | project_id=123a123456789b1234aab1cde | Yes |
reader[username] | reader[username]=support@knowledgeowl.com | Yes |
reader[ssoid] | reader[ssoid]=12345 | No, defaults to username if not specified |
reader[groups] | reader[groups]=Internal,Admin | No |
reader[first_name] | reader[first_name]=KnowledgeOwl | No
|
reader[last_name] | reader[last_name]=Support | No
|
reader[custom1] | reader[custom1]=Red | No
|
reader[custom2] | reader[custom2]=Orange | No
|
reader[custom3] | reader[custom3]=Yellow | No
|
reader[custom4] | reader[custom4]=Green | No
|
reader[custom5] | reader[custom5]=Blue | No
|
Step 2: Authenticate
You'll need to use the token generated in Step 1 to authenticate your reader. This endpoint is specific to your knowledge base's URL:
Customize this endpoint URL
https://support.knowledgeowl.com/help/remote-auth*
* Replace "support.knowledgeowl.com" with your KO site URL. For example, if my KO site URL is "myawesomekb.knowledgeowl.com", I 'd use https://myawesomekb.knowledgeowl.com/help/remote-auth
.
If you're unsure of your KO site URL, go to KB settings > Domain. Use either your KnowledgeOwl Sub-domain or your Private domain (if applicable).
Parameters | Example | Required? |
---|---|---|
n (token received in step 1) | n=1234567890 | Yes |
r (redirect) | r=/help/contact-us | No, will redirect to the homepage if not specified |
Example cURL access token request
Here is an example cURL access token request:
//basic authentication without reader information curl -G -X GET -u {API KEY}:X https://app.knowledgeowl.com/api/head/remotelogin.json -d 'project={Knowledge Base ID}' //authentication with reader information passed curl -G -X GET -u {API KEY}:X https://app.knowledgeowl.com/api/head/remotelogin.json -d 'project={Knowledge Base ID}&reader[ssoid]={Unique Reader ID}&reader[username]={Reader Email or Name}'
//example response
{"valid":true,"data":[{"status":"success","token":"12345678"}]}
Reader fields can be found in our API endpoint reference.
Example PHP script to run after authentication
Here is an example PHP script to run after authentication:
Example vb.net logic to get the token and open the default web browser passing the auth token
This example uses the NewtonSoft package in dot net to deserialize the JSON response. It was installed in Visual Studio using NuGet.
If you have trouble with NewtonSoft json deserializer you can always parse the token out of the response manually i.e.; strToken = strResponse.Substring(strResponse.IndexOf("token") + 8, 8)