Skip to main content

​
Core integration

The wheel installs plugins.single_sign_on. Plugin metadata mounts it at /sso/, registers its one-time-token path as public, and appends plugins.single_sign_on.middleware.sso.SSOMiddleware to Core middleware.

​
Model and flow

DisposableAuthenticationToken stores a token that links an authenticated user/profile to a target business and expires according to SSO_TOKEN_TTL_SECONDS.
  1. /sso/redirect/<business_id>/ creates or selects a cross-business destination.
  2. A one-time token is issued for the transition.
  3. /sso/one-time/<token>/ checks the token, expiry, user/profile, and target business.
  4. The token is consumed and the user is signed into the target context.
  5. The role-specific redirect setting determines the final destination.
The optional Google OAuth pipeline creates or resolves a temporary user, then SSOMiddleware moves eligible temporary profiles into the appropriate Ruoom business flow.

​
Routes

  • /sso/redirect/<business_id>/: initiate a business-to-business redirect (single_sign_on:sso_redirect).
  • /sso/one-time/<token>/: consume a UUID authentication token (single_sign_on:one_time_token_auth).