SSO Login for Freshdesk support portal - PHP Sample Code (Updated)

sso_login_freshdesk.php

<?php
define('FRESHDESK_SHARED_SECRET','____Place your Single Sign On Shared Secret here_____');
define('FRESHDESK_BASE_URL','http://{{your-account}}.freshdesk.com/');	//With Trailing slashes

function getSSOUrl($strName, $strEmail) {
	$timestamp = time();
	$to_be_hashed = $strName . FRESHDESK_SHARED_SECRET . $strEmail . $timestamp;
	$hash = hash_hmac('md5', $to_be_hashed, FRESHDESK_SHARED_SECRET);
	return FRESHDESK_BASE_URL."login/sso/?name=".urlencode($strName)."&email=".urlencode($strEmail)."&timestamp=".$timestamp."&hash=".$hash;
}

header("Location: ".getSSOUrl("User's Name","username@thecompany.com"));

Thanks for this. I created an ASP.Net c# version: https://gist.github.com/2718191

@barryokane Thanks a lot for your effort.

One function PHP sample: https://gist.github.com/4209441

Here's a Node.js version: https://gist.github.com/derekseymour/26a6fe573c1274642976

Congratulations!

But to me the code for NodeJS does not work when the name contains accent. it happens to other languages?

Hi, i am fresh php programming developer, how to do this SSO login ?

I am using the code above (albeit the original code from 2012) and it is working fine.

However, I was contacted by Freshdesk today with the following...

---

We noticed that you are using simple SSO and wanted to inform you that, moving forward, the format of your login details hash should be: Name, Shared secret key, Email address, and Timestamp (in that order). Please refer to this article and make the necessary changes ASAP.

As this is an important security update, we will stop supporting the old hashes by Thursday (28 April 2016) at 11 PM PDT.

---

Can you confirm your updated code conforms to the security update and if not, what changes need to take place to ensure it works prior to the above date?

I'm going to have a wild guess that the following line needs to be updated...

From:
return FRESHDESK_BASE_URL."login/sso/?name=".urlencode($strName)."&email=".urlencode($strEmail)."&timestamp=".$timestamp."&hash=".$hash;

To:
return FRESHDESK_BASE_URL."login/sso/?name=".urlencode($strName)."&hash=".$hash."&email=".urlencode($strEmail)."&timestamp=".$timestamp;

Basically just moving the "&hash=".$hash back a bit in the code to meet the new spec?

I've updated my code to the latest revision from 4 Dec 2013 and made the amendment noted above and it still logs in as expected. Guess I'll find out tomorrow whether my users can still login or not and I'll post back here.

@jonmc99 The URL doesn't need to be changed as URL parameters do not respect order. The only thing that I see that would need to be changed is:

$to_be_hashed = $strName . FRESHDESK_SHARED_SECRET . $strEmail . $timestamp;

Note: We're not using PHP for this solution, so this is untested, but it works in my brain ;-)

@42degrees Thats the change that needs to be done. Thank you.

@jonmc99 Sorry for the delay in updating this. I've changed the code, please let me know if it works or if you have any other issues with this.

Thanks for the feedback. That change matches what Freshdesk support also said.

I've updated my code and all tested to be working fine. Thanks for your assistance.

Oddly, my very original code (your original revision) also still works!

I am using this code but unable to login to freshdesk. Can someone help me. Thanks in advance.

function getSSOUrl($strName, $strEmail) {
$time = time();
return FRESHDESK_BASE_URL.
"login/sso/?name=".
urlencode($strName).
"&email=".
urlencode($strEmail).
"&timestamp=".
$time.
"&hash=".
getHash($strName,$strEmail,$time);
}

function getHash($strName, $strEmail, $time) {

$to_be_hashed = $strName . FRESHDESK_SHARED_SECRET . $strEmail . $time;
return hash_hmac('md5', $to_be_hashed, FRESHDESK_SHARED_SECRET);

}

I am facing a unique problem with this, the code works with email that do not consists of dot (.) before the @ sign.
If the email has a dot (.) e.g. firstname.lastname@gmail.com then the login does not work .
I think it could be because of the urlencode but not sure.
Any inputs/ suggestions???

Thanks

in Python
http://www.abhiy.com/single-sign-on-remote-authentication-in-freshdesk-by-python/
Here in python

Its works

An easier to read code with the help of PHP's http_build_query:

http_build_query([
  'name' => $strName,
  'email' => $strEmail,
  'timestamp' => $timestamp,
  'hash' => hash_hmac('md5', $str_to_be_hashed, FRESHDESK_SHARED_SECRET),
], '', '&');

The whole code is in this fork:
https://gist.github.com/AlLoud/cfdea1aac2d158f288deaa71ed186037

How do you guys handle a user's email address change scenario?