ValidateCredentials pipeline
Order | Pipe | Description |
|---|---|---|
100 | ValidateSenderIdentity | Uses the IAuthenticationService to validate the SenderIdentity username and SecretWord (SharedSecret). Fails if the user does not exist, is not allowed for the current website, is deactivated, is locked out, or is not in the PunchOut role. On success, sets AuthenticatedSender on the result. |
200 | ValidateFromIdentity | Resolves the FromIdentity user to sign in. If FromIdentity is the AuthenticatedSender, uses that user. Otherwise, the AuthenticatedSender must be in the PunchOutHub role, and the FromIdentity user must exist, not be deactivated, be allowed for the current website, not be locked out, and be in the PunchOut role. On success, sets UserProfile on the result. |
300 | SetUserAsAuthenticated | Fails if UserProfile is not set. Otherwise, uses the IAuthenticationService to set the FromIdentity user as authenticated. |
Every failure returns the same message, PunchOut Credentials are not valid., and writes the specific reason to the application log as a warning.
Custom pipes
ValidateSenderIdentity runs before ValidateFromIdentity, and the From user is bound to the authenticated Sender. Earlier versions ran these two pipes in the opposite order and did not bind From to Sender. If you added a custom pipe to this pipeline, review its Order value and any assumptions it makes about UserProfile.