Configuration/Setup
The table below outlines specifications for the required fields that need to be posted to the single sign-on URL for a successful authentication. There is a sample application in the Downloads section that can be referenced as an example for how the required fields are used, hashed, and posted to the SSO URL.
The single sign-on URL is: https://smartpay.profitstars.com/business/singlesignon/netteller
Required Information:
| POST VALUE | DATA TYPE | DESCRIPTION |
|---|---|---|
| ReferringApplication | Alphanumeric | Name of the application making the SSO request. |
| NetTellerID | Alphanumeric (40) | This number uniquely identifies the customer (merchant) in the EPS system. Customers/integrators typically use the EPS-generated Merchant ID (MID) for this value since the MID is always unique. |
| CMID | Alphanumeric (40) | Assigned by the merchant admin when creating a new user in JHA SmartPay Business™. It must uniquely identify the authenticated user in the customer's system. This value is created/generated by the customer's or integrator's internal system, not EPS. |
| SharedSecret | Alphanumeric (50) | Secure. Assigned by EPS Tech Integrations. Used to compute the hash. Must be stored securely in the customer's system so that it can be used to calculate the hash. Must never be submitted as part of the data in the POST. |
| Metadata | 1024 URL Encoded Characters | Optional. Assigned or generated by the customer's system. The metadata is passed through to the customer's system when the user logs out of SmartPay Business. |
| TimeStamp | mm/dd/yyyy hh:mm:ss TT | The date and time that the signal sign-on is initiated and format used in the post. Time must be in Central Time. |
| HashTimeStamp | mm/dd/yy HH:mm:ss | The date and time that the single sign-on is initiated and format used in calculating the hash. Time must be in Central Time. |
| Hash | 64 hexadecimal digits | Computed. Method described below. The hash is case sensitive and must be sent in all uppercase. |
| HASHALG | String | Optional Possible values:
|
If you are using JHA SmartPay Remote Deposit Complete™ (RDC) SSO in conjunction with JHA mRDC™ and/or JHA SmartPay Remote Deposit Now™ (RDN), the CMID value is required to be the same value as the mRDC "User Number" and/or the RDN "RDN ID" value. This is because all three values--CMID, User Number, and RDN ID--are housed within the same location for the merchant user in SmartPay Business.
In addition to the required information above, there are other settings that must be configured to control the behavior of the application when certain conditions occur, such as a failed login or a session timeout.
This information is not part of the post data, but is specified when the customer is configured for the single sign-on service.
| ADDITIONAL INFORMATION | DATA TYPE | CONDITION |
|---|---|---|
| Timeout URL | Valid URL | Assigned by the customer and provided to EPS. This is the static URL that SmartPay Business redirects to when a user times out due to inactivity. |
| Logout URL | Valid URL | Assigned by the customer and provided to EPS. This is the static URL that SmartPay Business redirects to when a user logs out of the system. |
| Login Failure URL | Valid URL | Assigned by the customer and provided to EPS. This is the static URL that SmartPay Business redirects to when single sign-on fails. |
Whenever one of the timeout, logout, or login failure conditions are met, SmartPay Business refers the user to the URLs as described above. The same information that is required by SmartPay Business for authentication is then posted back to the URLs, along with the metadata field if provided. All redirect URLs are required to accept a POST method or a 405 Method Not Allowed will occur.