Authentication Handoff API
The Authentication Handoff API lets your web portal sign a user in to the RAS User Portal and optionally launch a published resource immediately with a single HTTP POST. It replaces the legacy appinfo payload mechanism and is the supported method for all new integrations.
Unlike the legacy API, no launch data is passed through a URL and no JavaScript payload needs to be hosted by your web server. Credentials are submitted in a POST body directly to the RAS Secure Gateway, which validates them and responds with a redirect. Token creation, validation, and session handling are managed entirely by the User Portal Gateway — your integration never needs to inspect or manage JWT contents.
Endpoint
POST <https://<user-portal-domain>>/userportal/auth-handoffWhere <user-portal-domain> is the IP address or FQDN of the RAS Secure Gateway. The Enable User Portal option must be enabled for the gateway in the Parallels RAS Console.
How it works
The user signs in to your web portal, where the available published resources are listed.
The user clicks a resource (or your portal initiates sign-in to the User Portal).
The browser POSTs the handoff payload to the Gateway endpoint.
The Gateway validates the credentials and returns a
3xxresponse, typically302.The browser follows the redirect automatically to the User Portal destination — either the portal itself or, if appid was specified, the requested published resource.
Your responsibilities
Collect (or already have) the user's RAS username and password.
POST the payload to the Gateway endpoint from the browser.
Let the browser follow the returned
3xxredirect automatically.
That is the full scope of the integration. Anything beyond the redirect session handling, token management, resource launching is handled by the User Portal.
Note: If your frontend does not have access to the user's credentials, the POST can also be initiated from your backend. See Backend-Initiated Handoff.
The payload structure is described in the next section.
Last updated