Inbound SSO

These instructions guide you through the process of configuring and performing Single Sign-On (SSO) to Goldman Sachs Advisor Solutions (GSCS). The integration uses OAuth 2.0 to authenticate users and allow access to GSCS services.

UAT Testing

For testing in UAT, you will need to use different links.

• For Step 1 in section B, use https://idfs-qa.gs.com/

• For all other steps, use https://uat.advisorsolutions.site.gs.com

Part A. Setup SSO and User Authorization in GSCS (one time)

This part ensures that the partner is configured to request access to GSCS on behalf of the user.

You must add a button on your platform labeled "Authorize SSO to GSCS" that links to https://advisorsolutions.gs.com/app/authorizations/[client-id].

Steps for User

1. User clicks the "Authorize SSO to GSCS" button on the provider's interface

2. This action redirects the user to the GSCS User Authorization URL: https://advisorsolutions.gs.com/app/authorizations/[client-id]

3. Once redirected to the GSCS authorization page, the user logs in and is prompted to authorize the partner to access their GSCS account

4. User clicks "I authorize"

5. Upon successful authorization, GSCS redirects the user back to the partner with a response containing key information:

[
  "jwt": "string",
  "expiresIn": int
]

6. Partner processes the response and fetches loginid from the jwt and saves the GSCS loginId since the partner will need to send this GSCS loginId on future SSO calls.

Part B. Post-Authorization Steps to perform Inbound SSO

After the user completes the initial authorization step, they need to click on the "SSO to GSCS" button on the Partner interface to perform the inbound SSO.

You must add a button on your platform labeled "SSO to GSCS". When the user clicks this button, on the backend you will need to complete the below steps. Steps 1-3 should be done on the backend, and step 4 will require you to open a new tab on the client browser.

Step 1 - Obtain Access Token

Partner (from backend api client) generates a client credentials access token by making a call to the token endpoint using the clientId and clientSecret:

curl -u [clientId]:[clientSecret] --data "grant_type=client_credentials" https://idfs.gs.com/as/token.oauth2?access_token_manager_id=JwtOneGsApi

A successful response returns an access token:

[
  "access_token": "<redacted>",
  "token_type": "Bearer",
  "expires_in": 3600
]

This access token is used in Step 2.

Step 2 - Generate User Token

Using the client credentials access token from Step 1, retrieve (from backend api client) a user-specific token to proceed with the SSO process:

Make a POST request to the GSCS /tokens endpoint, passing the GSCS loginId that was retrieved from the initial user authorization step.

Endpoint: Get OAuth Token

Example Request: POST https://advisorsolutions.gs.com//api/v2/oauth-apps/[client-id]/tokens

Request Body:

[
  "loginId": "string"
]

A successful response provides a token for the logged-in user, which will be used in step 3.

Step 3 - Get SSO Code for User

Using the user access token from Step 2, from backend api client, make a call to get an sso-code from GSCS:

Make a POST call to the GSCS /sso-code endpoint, passing the GSCS loginId that was retrieved from the initial user authorization step.

Endpoint: POST /api/v2/oauth-apps/[client-id]/sso-code

Request body:

[
  "loginId": "string"
]

A successful response provides a sso-code for the logged-in user, which will be used in Step 4.

Step 4 - Open new tab to GSCS

Opens a new tab with the url:

https://advisorsolutions.site.gs.com/sign-in?ssoCode=[sso code from step 3]&loginId=[GSCS loginid]&clientId=[client-id]&redirectUri=/api/v2/accounts

The parameters ssoCode, loginId, and clientId are all required. The parameter redirectUri is optional- you can pass it if we need the user to land on a specific uri within GSCS, otherwise the default behavior if the redirectUri parameter is not passed is that the user will land on the GSCS homepage.

GSCS validates the ssoCode, loginId, and clientId parameters, and if all 3 parameters are correct, GSCS sets an authentication cookie and logs in the user.

Important Notes

• The clientSecret is not safeguarded by GSCS and must be securely stored by your administrators.

• Access tokens have a limited confidential validity and must be refreshed periodically.

• Users can revoke access through their account settings on the GSCS advisor portal. If a user revokes permissions, that will cause an unauthenticated error on Step 2.

Deep Links

The following links are some commonly used pages on our advisor portal. You can embed these links within your workflows as needed.

To get a memberoid, you can input a user’s loginid to the Get a user API call and it will return their memberoid.

To get an accountoid, you can input an account number to the Get an account API call and it will return the account.