Guidance on creating SSO extension using an SSO API

Question

Hello We re looking to add an SSO in online banking to the Fiserv uChoose Rewards site and we would like to use the uChoose Rewards SSO API provided by Fiserv to accomplish this The SSO API must first be authenticated using an access token generated by their Token API and then returns a SSO URL Is the SSO Extension the appropriate extension type to use or does it make more sense to use a Tecton extension here Are there any other security measures I should take into consideration I don t have experience with SSOs and want to ensure that I am building something secure for our members any guidance would be greatly appreciated Thank you Vivian

Trey Teter · Answer

Hello Vivian This is dependent on whether you want it inan iframe or as a new tab If it is as a new tab then definitely an SSO extension If you want it as an iframe in online banking then here is documentation on that https docs q2developer com guides frontend development enhanced sso html For either of them you control the security so you are required to do your own due diligence During code review one of the things Q2 looks for is security so we will look at that also and try and check for any holes From what I can tell this looks like a secure way of doing it just make sure the api calls are done with the Python code and that the user only gets what is absolutely necessary to perform the operation Thank you Trey Teter

Answers