Non-secure Message in Chrome During SSO

Jeremy Isett

In our Luminate SSO integration we use the EstablishSession endpoint to establish a session on the Luminate site, following the documentation: http://open.convio.com/api/apidoc/general/sso_convio_as_client.html


We have reports of folks getting a warning in Chome about a non-secure redirect: Screen Shot 2020-12-15 at 2.33.36 PM.png. (Screen shot attached.)


In the SSO process the user is initially sent to an https page on the Luminate site (https://secure2.convio.net). In viewing the network history we can see that once the user is on that system, there is an additional redirect to a non-secure Luminate URL. Screen Shot 2020-12-15 at 3.52.22 PM.png


Is there a way for us to avoid that additional non-secure redirect?

Noah Cooper

By default, the EstablishSession servlet is always non-secure, so if you attempt to access it over HTTPS you'll get a redirect to HTTP. With a customization, though, Blackbaud can make EstablishSession "multi-channel", meaning that if you access it over HTTPS no redirect will occur. If that's something you're interested in, you can reach out to your account representative. (If you have an existing project with Blackbaud Professional Services such as a monthly retainer, this can be changed through that project too.)

Brandy Reppy

Thanks, Noah - interesting. Nothing has changed on our side, so wondering if you're seeing this with other customers specifically with Chrome. We're concerned that this was a Chrome update that appears to be interfering with our donors' ability to log in. We've tested this before, but are only seeing this issue recently. Thoughts?