Skip to main content

         This documentation site is for previous versions. Visit our new documentation site for current releases.      

This content has been archived and is no longer being updated.

Links may not function; however, this content may be relevant to outdated versions of the product.

Custom single sign-on with a servlet

Updated on September 10, 2021

This presentation is part of the Authentication Overview Self-Study Course.


Now let’s talk about custom Single Sign-on applications.  Typically, implemented as a Servlet, it presents a uniform application sign-in page for any application that is accessed via a web browser.  Its main function is to handle user name and password authentication with a corporate LDAP directory.  However, it also implements password policies and prompts the user to change their password if the LDAP server reports that the password has expired.

If the user has been successfully authenticated, the login Servlet presents the “application home page” (i.e., a screen with links to all applications the user is authorized to access).  This screen is dynamically built from information returned by the LDAP server.  When the user clicks a link that points to a PegaRULES based application, they are redirected to a PRPC Servlet.

The login Servlet and the PegaRULES Servlet may or may not reside in the same application server.  This link between the login Servlet and the PRPC application may be vulnerable to replay attacks.  To secure the communication, the login Servlet generates a so-called security token.  This token is computed from several components, including a secret pass phrase that is shared between the login Servlet and PegaRULES.  The login Servlet passes the computed token to PegaRULES in a URL parameter.  The PegaRULES activity that receives control in the login process, too, generates the security token.  If the generated token and the token passed in the URL match, PegaRULES deems the request as legitimate.

In the next Authentication e-Learning course we will dig into the details of each of these security options we just discussed.

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best. is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us