<commit_before># iwwa-back

This is the repository of of the iwwa project backend. The source code for the
the frontend can be found at
[innowatio/iwwa-front](https://github.com/innowatio/iwwa-front).


## Development environment setup

If you don't have `meteor` installed, you can install it following instructions
at [meteor.com/install](https://www.meteor.com/install).

```sh
git clone https://github.com/innowatio/iwwa-back.git
cd iwwa-back
meteor
```<commit_msg>add documentation for sso integration<commit_after># iwwa-back

This is the repository of of the iwwa project backend. The source code for the
the frontend can be found at
[innowatio/iwwa-front](https://github.com/innowatio/iwwa-front).


## Development environment setup

If you don't have `meteor` installed, you can install it following instructions
at [meteor.com/install](https://www.meteor.com/install).

```sh
git clone https://github.com/innowatio/iwwa-back.git
cd iwwa-back
meteor
```


## Innowatio SSO integration flow

Some explanation about the integration with Innowatio SSO system considering both server and client side.

##### <a name="token"></a>Login with Innowatio token
1. Client-side, when the user is logged out from meteor, a request is made to the SSO system in order to get the user's Innowatio token:
- If it doesn't return any token, user is not authenticated in the SSO system, therefore a login form is showed and user can proceed with [credentials authentication](#credentials).
- If a token is returned, meteor login can be called as:
```javascript
Asteroid.login({
    sso: {
        tokenId: returnedTokenId 
    }
});
```
2. In the second case, server-side token is validated and user's information are persisted to the app users collection.
3. Once everything is done successfully, meteor authentication is provided.

##### Meteor authentication resume (and single sign out)
1. Server-side, with the resume of meteor authentication for a user, his Innowatio token is validated:
- If the token is still valid, user's information are updated and meteor authentication is resumed.
- If the token is not valid, user is logged out from meteor, implementing single sign out (in fact SSO system invalidate token on user logout).
2. In the second case, application flow will [check again for a new Innowatio token](#token)

##### <a name="credentials"></a>Login with credentials
1. When a user is logged out from meteor and Innowatio SSO system, one can login with Innowatio credentials. Meteor login can be called as:
```javascript
Asteroid.login({
    sso: {
        username: value,
        password: <PASSWORD>
    }
});
```
2. Server-side, authenticate call is made to the SSO sytem which provide a token in case of success. User's Innowatio token is persisted together with user's information.
3. Meteor authentication is also established.

##### Other client-side facts
- Whenever a user is authenticated with meteor, user's Innowatio token is set also in the SSO system (a specific domain).
- Whenever a user manually logout from application, besides meteor logout, user's Innowatio token is also removed from SSO system.
{'fraction_non_alphanumeric': 0.08285348688419705, 'fraction_numerical': 0.0025591810620601407, 'mean_word_length': 4.391379310344828, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 8, 'https://': 6, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7401426', 'n_tokens_mistral': 910, 'n_tokens_neox': 843, 'n_words': 411}