title: How secured is SSO based on token based authentication?
body: <p>I am planning to integrate jasper server with my web application as Single Sign on. I went through <a href="http://community.jaspersoft.com/system/files/restricted-docs/jasperreportsserver-auth-cookbook_2.pdf" rel="nofollow">Jasper Authentication cookbook</a>
  and jasper
  suggest Token based authentication as one of the solution (as authentication is already done by my web application)</p>
  
  <p>What Jasper suggests is this </p>
  
  <blockquote>
    <p>you pass the token in specific format (as defined below under tokenFormatMapping) to jasper server 
    , jasper will authenticate the request.</p>
  </blockquote>
  
  <p><strong>So valid tokens can be</strong></p>
  
  <pre><code>   u=user|r=role1|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601
  </code></pre>
  
  <p><strong>Invalid token can be</strong> </p>
  
  <pre><code>   u1=user|r=role1|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601
     r=role1|u=user|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601
  </code></pre>
  
  <p><strong>My question is this really a secured process because as soon hacker knows the pattern, he can simply login to jasper server ?
  To me looks like security can be compromised here.  Am i missing something here?</strong>  </p>
  
  <pre><code>&lt;bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.preauth.JSPreAuthenticatedAuthenticationProvider"&gt;
   ....................
        &lt;property name="tokenPairSeparator" value="|" /&gt;
        &lt;property name="tokenFormatMapping"&gt;
          &lt;map&gt;
            &lt;entry key="username" value="u" /&gt;
            &lt;entry key="roles" value="r" /&gt;
            &lt;entry key="orgId" value="o" /&gt;
            &lt;entry key="expireTime" value="exp" /&gt;
            &lt;entry key="profile.attribs"&gt;
              &lt;map&gt;
                &lt;entry key="profileAttrib1" value="pa1" /&gt;
                &lt;entry key="profileAttrib2" value="pa2" /&gt;
              &lt;/map&gt;
            &lt;/entry&gt;
          &lt;/map&gt;
        &lt;/property&gt;
        &lt;property name="tokenExpireTimestampFormat" value="yyyyMMddHHmmssZ" /&gt;
      &lt;/bean&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>