HotlinkHR SSO

Manual Token Submission

API Instructions

Construct the plain text of the token as a UTF-8 encoded string including:
1. The employee id
2. Pipe character
3. Current date and time ISO 8601 formatted
For example:
```
12345|2014-02-27T15:03:47-08:00
```
Encrypt the plain text token as an ASCII armored PGP Message using the public GPG key for api@hotlinkhr.com

Include PGP message in a form POST to https://www.hotlinkhr.com/sso/ in a post variable named ssotoken (note the trailing slash)

For example:

ssotoken=-----BEGIN+PGP+MESSAGE-----%0d%0aVersion%3a+GnuPG+v1%0d%0a%0d%0ahQEMA26dWeb7qHFeAQf%2feYT12Cw4JPV3LGGn2MBzvs%2ftDPFAvRVS0QCqTkeyrhW2%0d%0abzbIQKCZVYuQ4gNNea0w2JP5pTuX%2bpfTj9uzwIxU6JE2E2gXoFvN0HGYBA2Y%2bp2B%0d%0a7LOzLcQ4FncmC9irfIY0ngwY%2fm0Sw0HOYVSQh8byq%2b48%2bQpeV9%2bVeaLy7%2bgDiZwH%0d%0a%2fmit1RB2WOguAnlwl7jsbMUs%2fyFfGmleVKUUlXUO5QgNc1qR13Fk4Jh5amUPiM5a%0d%0aQQHWLJ%2fdYqSc2VIEENB97H6LWm1PwyR5oPhgzL4fwerleoDptiXB%2byUWEgUPP1cH%0d%0acIBYDKOXoFW46U%2fd8jBUumQ9ib20hqKFvsES1Jm9JNJnAQ9XgUjexxraSCV8TsU2%0d%0aJUMqqrqYGaFjRn0Sqno8fXodvHzf4wApFu%2fG2idP9y%2b3xbkouJNUJzImqR7Yj0gs%0d%0aTNX4mTbpMki5sPn2nlpN3ouE%2f2j%2bxcRpTtwFFT4ABzwPoYho%2biE%2fOg%3d%3d%0d%0a%3d%2bzYI%0d%0a-----END+PGP+MESSAGE-----%0d%0a

This will immediately log the user in and redirect to the home screen. To see this debug screen instead for the results, include a second form variable: debug=1

For example:

debug=1&ssotoken=-----BEGIN+PGP+MESSAGE-----%0d%0aVersion%3a+GnuPG+v1%0d%0a%0d%0ahQEMA26dWeb7qHFeAQf%2feYT12Cw4JPV3LGGn2MBzvs%2ftDPFAvRVS0QCqTkeyrhW2%0d%0abzbIQKCZVYuQ4gNNea0w2JP5pTuX%2bpfTj9uzwIxU6JE2E2gXoFvN0HGYBA2Y%2bp2B%0d%0a7LOzLcQ4FncmC9irfIY0ngwY%2fm0Sw0HOYVSQh8byq%2b48%2bQpeV9%2bVeaLy7%2bgDiZwH%0d%0a%2fmit1RB2WOguAnlwl7jsbMUs%2fyFfGmleVKUUlXUO5QgNc1qR13Fk4Jh5amUPiM5a%0d%0aQQHWLJ%2fdYqSc2VIEENB97H6LWm1PwyR5oPhgzL4fwerleoDptiXB%2byUWEgUPP1cH%0d%0acIBYDKOXoFW46U%2fd8jBUumQ9ib20hqKFvsES1Jm9JNJnAQ9XgUjexxraSCV8TsU2%0d%0aJUMqqrqYGaFjRn0Sqno8fXodvHzf4wApFu%2fG2idP9y%2b3xbkouJNUJzImqR7Yj0gs%0d%0aTNX4mTbpMki5sPn2nlpN3ouE%2f2j%2bxcRpTtwFFT4ABzwPoYho%2biE%2fOg%3d%3d%0d%0a%3d%2bzYI%0d%0a-----END+PGP+MESSAGE-----%0d%0a

For debugging purposes, valid token dates/times are one week past or future. The live system will be something more like 5 minutes (to allow for server time differencs). Thus, you can test expired tokens by setting the date/time to more than one week away in either direction.