title: Using DotNetOpenAuth for NetSuite SuiteSignOn (Outbound Single Sign-on)
body: <p>I am trying to figure out how to use DotNetOpenAuth (DNOA) to interface to NetSuite's SuiteSignOn. I have a java example I am trying to duplicate the function of, but I am new to OAuth. Here is what I have to work with:</p>
  <p>This is the high level of what NetSuite wants to happen:</p>
  <ol>
  <li><p>User logs in to NetSuite, initiating a NetSuite session.</p>
  </li>
  <li><p>User clicks on one of the following in the NetSuite user interface:</p>
  <p>o A subtab that provides SuiteSignOn access<br />
  o A page displaying a portlet that provides SuiteSignOn access<br />
  o A link for a Suitelet that provides SuiteSignOn access<br />
  o An action button that results in the execution of a user event script that provides SuiteSignOn access</p>
  </li>
  <li><p>NetSuite generates a token, and sends this token to the external application as the value for the oauth_token URL parameter. This outbound HTTP call also includes a dcand an env URL parameter. These values can be mapped to the URL to be used for NetSuite access (see Mappings of dc and env URL Parameter Values). If any data fields were previously defined as required context for the connection, NetSuite sends values for these fields at the same time.</p>
  </li>
  <li><p>The external application sends back to NetSuite the token, the consumer key, and its shared secret, along with other information such as the timestamp and nonce, in order to verify the user. The consumer key is a unique identifier for the application provider, generated by NetSuite when the application provider sets up a SuiteSignOn connection. The shared secret is a password defined by the application provider during this setup.</p>
  </li>
  <li><p>NetSuite responds to the verification, sending any user identification information that was previously defined as necessary for the connection, in XML format. This information may include standard fields like email address or name, or custom fields.</p>
  </li>
  <li><p>The external application sends the HTML for the landing page, and the page displays. Or, if there is a problem, an error is returned instead.</p>
  </li>
  </ol>
  <p>NetSuite HTTP Outbound Call (got this figured out).</p>
  <p>When a user accesses a SuiteSignOn connection point, NetSuite issues an outbound call to start the handshake. The following is an example of this call:</p>
  <pre><code>GET /SSO/demoApp.php?oauth_token=01046c1211661d6c6b415040422f0daf09310e3ea4ba&amp;dc=001&amp;env=PRODUCTION HTTP/1.1
  Host: externalsystem.com 
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0 
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
  Accept-Language: en-US,en;q=0.5 
  Accept-Encoding: gzip, deflate 
  Connection: keep-alive 
  </code></pre>
  <p>External Application HTTP Verify Call (trying to prepare this with DotNetOpenAuth).</p>
  <p>Upon receipt of the NetSuite HTTP outbound call, the external application needs to issue an HTTP verify call. The following is an example of this call:</p>
  <pre><code>GET /app/common/integration/ssoapplistener.nl HTTP/1.0
  Host: system.netsuite.com
  Authorization: OAuth oauth_token=&quot;01046c1211661d6c6b415040422f0daf09310e3ea4ba&quot;, oauth_consumer_key=&quot;3moWE2ukbW4lohz7&quot;, oauth_signature_method=&quot;PLAINTEXT&quot;, oauth_signature=&quot;foobar1%26&quot;, oauth_timestamp=&quot;1364997730&quot;, oauth_nonce=&quot;392380036&quot;
  </code></pre>
  <p>NetSuite HTTP Verify Call Response (I can code this).</p>
  <p>Upon receipt of the verify call from the external application, NetSuite sends a response. The following is an example of this response:</p>
  <pre><code>HTTP/1.1 200 OK
  Date: Tue, 16 Apr 2013 13:30:41 GMT
  Server: Apache/2.2.17
  Set-Cookie: lastUser=1326288_79_3; expires=Tuesday, 23-Apr-2013 13:30:42 GMT; path=/
  Set-Cookie: NS_VER=2013.1.0; domain=system.netsuite.com; path=/
  X-Powered-By: Servlet/2.5 JSP/2.1
  P3P: CP=&quot;CAO PSAa OUR BUS PUR&quot;
  Vary: User-Agent
  Connection: close
  Content-Type: text/html; charset=utf-8
  
  &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;outboundSso&gt;
      &lt;entityInfo&gt;
          &lt;ENTITYLASTNAME&gt;Smith&lt;/ENTITYLASTNAME&gt;
          &lt;ENTITYINTERNALID&gt;79&lt;/ENTITYINTERNALID&gt;
          &lt;ENTITYACCOUNT&gt;1326288&lt;/ENTITYACCOUNT&gt;
          &lt;ENTITYFIRSTNAME&gt;John&lt;/ENTITYFIRSTNAME&gt;
          &lt;ENTITYEMAIL&gt;jsmith@netsuite.com&lt;/ENTITYEMAIL&gt;
      &lt;/entityInfo&gt;
  &lt;/outboundSso&gt;
  </code></pre>
  <p>The excerpts of a Java example using OAuth 1.0a that I'm trying to port to .net/DotNetOpenAuth:</p>
  <pre><code>import net.oauth.OAuth;
  import net.oauth.OAuthAccessor;
  import net.oauth.OAuthConsumer;
  import net.oauth.OAuthMessage;
  import net.oauth.client.OAuthClient;
  import net.oauth.http.HttpMessage;
  
  &lt;&lt;snip&gt;&gt;
  
  OAuthConsumer consumer = new OAuthConsumer(null, CONSUMER_KEY, SHARED_SECRET, null);
  consumer.setProperty(OAuth.OAUTH_SIGNATURE_METHOD, &quot;PLAINTEXT&quot;);
  OAuthAccessor oauthAccessor = new OAuthAccessor(consumer);
  
  //Get the token from NetSuite
  oauthAccessor.accessToken = request.getParameter(&quot;oauth_token&quot;);
  
  &lt;&lt;snip&gt;&gt;
  
  OAuthMessage rqt = null;
  rqt = oauthAccessor.newRequestMessage(&quot;POST&quot;, ssoVerifyUrl, null);
  HttpMessage message = 
  
  rqt.toHttpRequest(OAuthClient.ParameterStyle.AUTHORIZATION_HEADER);
                  verifyConnection.setRequestProperty(&quot;Authorization&quot;, 
  
  message.getHeader(&quot;Authorization&quot;));
  </code></pre>
  <p>Being new to OAuth and DotNetOpenAuth, I'm fumbling around.</p>
  <ul>
  <li>What is the proper replacement for OAuthConsumer in DNOA in this situation?  WebConsumer? DesktopConsumer?</li>
  <li>Assuming I need such a consumer, how much of the ServiceProviderDescription do I need to provide? I only have one endpoint (/app/common/integration/ssoapplistener.nl), I'm not sure if that is a Request, Access, or other type of endpoint.</li>
  <li>What is the proper replacement for OAuthAccessor in DNOA?</li>
  </ul>
  <p>Thanks for any assistance,
  Bo.</p>