Announcements
There are no announcements for this release.Connect Features
This section describes the key updates in this release.Enhancements to the Onboard, Authenticate, and Purchase Process
In the Connect (2021.06) release, Vindicia introduced and previewed a new Connect API Process that combines onboarding and authentication, with additional options to add account association and a prompt for product or subscription purchase, all in one seamless flow. This is a highly configurable Process built to support multiple, optional flows in Connect’s out-of-the-box IdP UI. It is also available to organizations who want to build their own sign-up/sign-in screens using Connect Processes. This new Process does not replace Connect’s existing onboarding, authentication, or account-based Processes. Those Processes remain available as streamlined, less complex options for organizations that leverage the Connect Process catalog. However, the new Onboard, Authenticate, and Purchase Process serves as a powerful “all in one” solution with multiple configurable flows. As of this release, the Onboard, Authenticate, and Purchase Process can now automatically provision a Vindicia Subscribe account in the background when an end user onboards using the Process, if the following application settings are configured as follows:- Create OTT account = true
- Account discovery = false
This Process is still in a refinements stage, subject to additional enhancements and refinements. Feel free to reach out to Connect Product team if you are interested. Once it has been finalized, full documentation for the Process will be provided in a subsequent release.
New Connect API to verify an end user’s PIN
Connect enables end users to register optional 4-6 character PINs on their profile (that is, on their Connect User entity), in addition to standard passwords. Client applications can enforce or require PINs in order to restrict access for areas of a given application, such as security or parental settings. The PIN is a conventional option in use cases where an end user wants to perform a Session Switch between a Regular User and Soft Profile User, when sharing access to a service. As of this release, Connect now includes a new API to verify an end user’s PIN: The POST /user/verifyPIN validates an authenticated end user’s PIN (if they have one). This API does not perform or require a session switch between separate Users, and it is actually more efficient (faster response time, lower size) in comparison. See the full API details in the ULM APIs section MarketONE’s API Reference, or directly access the API spec in SwaggerHub.Support for In App Purchase (IAP)
Vindicia Subscribe supports an IAP Synchronization Service Extension. This Extension is designed for Subscribe/SLM merchants who offer their subscription-based services through third-party billing platforms that allow their customers to be able to purchase subscriptions to their services as in-app purchases supported by the device stores (for example, Apple iTunes, Google Play Store, Amazon FireTV Store, etc.). As of this release, Connect users will be able to purchase a subscription using IAP from Apple Store or Google Play. Once the user is authenticated, the client application calls POST /subscription/purchase from Storefront-Gateway Subscription. This API triggers a purchase of a subscription with passed parameters (for example, accountId, productId, paymentMethodId). Connect then calls POST /iapreceipt from MarketONE SLMGW and captures IAP receipt information, validates it with appropriate IAP store, and creates a subscription in Vindicia Subscribe.Associate Billing Account to User Process - version 2 supports One-time Passcode (OTP)
The Associate Billing Account to User Process queries a service provider’s external Billing or Operations Support Service (B/OSS) for an end user’s specified account data. If successful, the Process takes information from the external system and maps it to a Connect Account data entity (including any ULM Subscription and Feature entities, depending on the integration between Connect and the B/OSS). As of this release, the Process has been updated to a version 2, fully replacing the previous version. Associate Account V2 issues and sends an action token in the form of a One-time Password (OTP) to the end user, and the end user must then provide that token to the client (and the client to the Process) before Connect will call the external account system to create, activate, and associate the Account entity to the corresponding User entity. Prior to this release, the V1 Process prompts the end user to answer a challenge question. This question was configurable, but impractical for organizations to implement. At a high level, the user journey remains the same as the previous version, with the only exception being that the OTP verification replaces the challenge question.- The end user enters a mobile number (support for email addresses and account numbers are roadmapped for a future release)
- Connect queries the external account system and, if an account is discovered, sends an OTP to mobile number tied to that account.
- The end user receives the OTP, and then provides it to the client application (which then passes back to Connect).
- Connect validates the OTP and, if valid, creates the Connect Account entity using the external account data.
New app setting to automatically issue Remember-me cookies
Once an end user successfully authenticates with Connect, the API response returns a JSESSIONID token and an optional remember-me token (called themint-sso-token) for the user’s session management. These tokens are transparently placed in the end user’s browser as cookies. Remember-me tokens are optional, long-lived tokens (between hours, days, and even months) that are used to transparently recreate a user’s session without the need for the user to authenticate again. They enable the “Remember Me” auto-authentication for users who leave and return to a service.
Typically, if a client wants to leverage Remember-me cookies for auto-login, then that client needs to specify the Remember-me token as a query parameter in the API authentication request. As of this release, MarketONE has a new app setting that, when enabled, automatically creates and returns a Remember-me token for every authentication request. This feature is backwards compatible - client applications that currently send the Remember-me query parameter on authentication calls can continue to do so, but they are encouraged to take advantage of the new setting.
This setting is internally named Remember-me always. Generally, settings that govern Remember-me functionality include:
- Remember-me always — enables/disables the functionality described above.
- Remember-me token validity in seconds — controls the lifetime (that is, time until expiration) of a Remember-Me token, in seconds, once it is issued to a user. Users who opt to authenticate with the “Remember Me” option must revisit Connect (and thus re-construct their session with that Remember-me cookie) at least this often to maintain their long-lived sessions. For example, if the setting is 6 months (15780000 seconds), then the end user needs to revisit the service once every six months to maintain their Remember-me auto-login. Every time the end user revisits the service with a valid Remember-me cookie, their session will re-constructured using the Remember-me cookie (and they are issued a new cookie to replace it).
Update Password Process invalidates OIDC access tokens (except user’s current session)
The Update Password Process allows an authenticated user to add new password (in cases where an end user onboards without one) or update their current one. As of this release, when an end user executes this Process, Connect will invalidate all OAuth/OIDC-based access tokens except the user’s current access and current refresh token are invalidated. In other words, if an end user has more than one session open (for example, they are signed into an application on their desktop browser, their mobile browser, and another device), and they then update their password, then all sessions except the current one are invalidated. The end user will need to re-authenticate if they return to the service on separate devices.Enhancements to the Connect IdP UI
The Identity Provider (IdP) UI is a ready-to-use onboarding, authentication, and ID management application for users. This UI leverages the same Connect APIs and Processes that are available to clients for their own site or service implementation. As of this release, the IdP now supports:- A “dark theme” across all IdP screens (configurable through an app setting)
- End users can now add or update their PIN on the ID/Profile Management screen
- The UI displays a “success” page after an end user successfully changes their password