Authentication API

Authenticate with Northeastern SSO

Redirects to (or returns) a Northeastern SSO URL to begin user authentication process

GET /api/v2/login

Request Parameters

Body Parameters	Type	Required	Description
no_follow_redirect	Bool	No	Set value to true to get a JSON object returned with SSO Login URL. Default bahavior returns a 302 Redirect.

Success Responses

no_follow_redirect: false (default)

HTTP/1.3 302 Found
Location: https://neuidmsso.neu.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest={TOKEN}&RelayState=https://get.cbord.com/northeastern/full/login.php?mobileapp=1

no_follow_redirect: true

{
    "sso_url": "https://neuidmsso.neu.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest={TOKEN}&RelayState=https://get.cbord.com/northeastern/full/login.php?mobileapp=1",
    "message": "Login Flow Started"
}

Failure Responses

`no_follow_redirect` set to non-Boolean value

{ 	
	"message": "Parameter 'no_follow_redirect' set to non-boolean value" 
}

Details

Authentication Redirect URL Chain & Additional Details

1. https://neuidmsso.neu.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest={TOKEN}&RelayState=https://get.cbord.com/northeastern/full/login.php?mobileapp=1
2. ... (Northeastern SSO Authentication URLs)
3. https://get.cbord.com/northeastern/full/mobileapp_login_validator.php?sessionId={SESSION_ID}

NOTE

SESSION_ID is a UUIDv4 string which CBORD uses as session tokens for the GET Mobile Application. The initial SESSION_ID token is a valid SESSION_ID and the page will say "validated", however if you arbitrarily replace that UUIDv4 token it seemingly will still say "validated" despite the new token not being valid, unsure why that is.

Closing Sessions

Closes a session using SESSION_ID

POST /api/v2/closeSession

Request Parameters

Body Parameters	Type	Required	Description
session_id	string	YES	session_id to close.

Success Response

{
	"response": true,
	"exception": null
}

Renewing Sessions

Renews SESSION_ID tokens using DEVICE_ID and PIN if SESSION_ID is expired, else returns the same SESSION_ID.

POST /api/v2/auth

Request Parameters

TIP

Providing the existing or last known session_id can help cut down on unnecessary sessions. Each time you create a new session, the old session is not automatically closed, and session_id tokens don't expire for a couple days.

Body Parameters	Type	Required	Description
device_id	string	YES	UUIDv4 identifer for each device
pin	number(4)	YES	4-digit PIN set upon login. Also used in case of not being able to use biometrics to authenticate in GET Mobile App
session_id	string	NO	If configured, will attempt to validate Session and if valid, returns same session_id, else creates a new session using device_id and pin

Success Response

{
	"response": "{SESSION_ID}",
	"exception": null
}

Failure Reponse

9510: Device Marked As Lost

TIP

Usually this just means the device was never registered to a User Account. I assume a lost device returns the same error code.

{
	"response": null,
	"exception": "9510|Device marked as lost"
}

9504: Invalid PIN

TIP

This occurs when the device_id does exist, but the pin is wrong.

{
	"response": null,
	"exception": "9504|Invlaid pin login credentials."
}

NOTE

No, that's not a spelling error on my part. That's the exact response CBORD provides when the device_id exists, but the PIN is wrong.