@EishiFUN
Are you saying that there is no support for URL integration using BasicAuthentication?

@DFenn-1143 Nothing like that is supported that I know of, but you could maybe do it a hacky way by looking at what Geotab is storing in the browser Cookies / local storage and then recreating that from API authentication, but that's not supported and could break at any time if Geotab changes anything. Is there a reason you want this specific workflow where users log in without ever knowing their passwords?

@TuckerBA-1087 You had this auto login feature before. It was in the help pages of your site from ~2016.

This helps us manage their credentials and access, without them ever having to know that there is a portal.
We launch the URL in an embedded browser window in a WinForms application.

Thanks

@DFenn-1143 I'm not actually part of Geotab, we're Geotab partners, and unfortunately I wasn't here in 2016 so I'm not aware of anything back then, but Geotab does support SAML which you might be able to use for that assuming the users do have users in your system that would be compatible with it. Otherwise the only thing I can think of would be the hacky way I mentioned before unless someone else knows something different. Sorry I couldn't be more help!

@EishiFUN It is kind of documented here - https://developers.geotab.com/myGeotab/guides/myGeotabUrls/#credentials - but it doesn't give any direct example of passing the session ID into the URL but it is possible to do for like a Kiosk login senario.

@DFenn-1143It doesn't given an example of how a session ID should be added, and with since the introduction of CIAM and Unified Login password management has been removed from the MyGeotab database level all to gether. Unless the user account doesn't have an email address (they still need to have a unique username in CIAM though, and conflicts for usernames like "JohnSmith" are lot more possible). As @TuckerBA-1087mentioned it might be easier to integrate SAML SSO into your application use that method to access the Geotab portal.

Depending on how you're displaying the portal in the application it my prevent access if doing it through an iFrame in a browser-like application - https://developers.geotab.com/myGeotab/guides/myGeotabUrls/#embedding-myg-in-iframe

@mhead-1468 Hi Michael,
So you think AuthenticationType=BasicAuthentication and ChangePassword=false will work?

Yes, its Daniel.

@DFenn-1143 Yes but I would make it a clearance to not allow Change Password. If your app can log the user in on the device, then the user should get the session. This really is based on how the frontend app is logging the user in.

@mhead-1468 What about non-real emails?
We use fake emails because we don't want the user to know about their profile and we want to control their password. This means Geotab needs to allow creation of the user without sending an invite/confirmation email and also allow portal access via an embedded URL in the app.

@DFenn-1143 I would recommend that you create one email in your system for the inbox like mylogin@yourdomain.com. Then for each user just add a "+" after mylogin and then the user identifier before "@" to identify your user for their email. The emails will all go to your one inbox.

it is called plus addressing or sub addressing
Example:

• Your main address: you@example.com
• Plus alias: you+work@example.com or you+news@example.com

When someone sends mail to the plus alias, the mail server ignores the “+” and everything after it and delivers it to your primary inbox

@mhead-1468 That is an interesting work around, but we don't want to be in the business of getting/managing emails for users..
Anyway, the biggest confusion with Geotab is that existing code works perfectly in prod (BasicAuthentication + ChangePassword=false).

A couple of months ago, I was testing in QA (Sandbox), and noticed the warning message about emails. And it stopped working for Basic Auth. I assumed it was Prod as well, but not really.

So are they controlling via a config (set differently in QA) and this Sunbelt kind of integration is allowed and will remain in Prod OR
Is it a valid code change / enforcement that is on the way to Prod, eventually?

@DFenn-1143 I am not sure on the QA. I know a few months back they began pushing accounts to be real emails even on private apps and service accounts we were told to start migrating.

You said you use fake emails anyway? I would pick a way that you can make work but I would count on having to have a real email just in case. You can just create a logic app to handle all incoming email to that one email account. It still satisfies the other requirements.