Do you have a login on Lighthouse? It has a working example (of course, you must be logged in to see it). Also, is the end quote really on the next line? I don't know if that's a copy/paste error or not. I'd think the example should look more like this:

<script type="text/javascript" charset="utf-8">
  Tender = {
    sso: "jJGIoUdNG87jy+ZNEx+dZ6wzkQq1KT/RNdJ4npbzfbaZI1Jw8U0mj1t1I5Ah
jxueh2aSpWsBpwhFF7lRfFexjyNZX4BfTAIphjIlJZqNWHcvdV1Nw2lMv0Hu
6m4ekJvD1RNK+z3/ETPG/AjfJJtORoQfyv0qoUrYMyRp0NGHdpU="
  }
</script>

I may add some debug mode to the JS widget code.

Also, check the new multipass debugger in the Extras section of your Tender dashboard. I modified the MultiPass spec a bit, but it should avoid weird url escaping issues (legacy multipasses are still fully compatible still).

i just signed up for lighthouse, can you point me to the working example. Here's the erb that generates what I have.

<% if current_user %>
<script type="text/javascript" charset="utf-8">
  Tender = {
    sso: "<%= current_user.multipass() %>"
  }
</script>
<% end %>

Try pasting the resulting multipass token into the multipass debugger.

the problem seems to be that self.class.multipass.encode seems to be putting new lines in the result. I don't quite understand why.

That's the output from the Base64 function. I've attached a beta of
the new MultiPass gem that handles this much better, using "url safe
base64 strings". I forgot to push the changes upstream from my
laptop, and now it's at home.

The MultiPass debug page shows the current rules that are supported by
the new multipass gem.

Thanks. That's what I"ve also just figured out. So it seems that if
you want to add a tender.sso field, it needs to have the line breaks
taken out. This seems like a useful thing to document.

--dan

PS We are evaluating using Tender for a new product & I'm super
impressed with how easy the integration has been. Documentation is a
bit confusing but not too bad.

Did you check out the Multipass debugger? It has these steps outlined already. It's in the Extras section of the Admin dashboard. The SSO integration has gone through a few phases as we figure out what works best. Originally we only integrated with cookies, but that had other issues. I've been working with someone else with a similar issue like yours, and deployed the modified spec that mentions url-safe base64s yesterday.

yah, I've used it. It's been quite helpful. But again, this
particular wierdness has to do with trying to put an SSO as a tender
initialization before calling the javascript (which I'm sure I can't
be the only one trying to do this). the javascript doesn't like the
newlines that base64 puts in, so I need to delete them from the string.

--dan

Yes, that's why I added it to the MultiPass page :) Are you referring
to the Widget page? I didn't actually write it, and didn't realize it
neglected to mention the SSO parameter at all. I'll fix that.

I updated the multipass rules again. You can strip the trailing `=`
symbol now. The code (using the old multipass gem, v1.1.x) might look
something like this:

@@@ ruby
def current_multipass
  return nil if !logged_in? # assuming restful-auth?
  mp = current_user.multipass
  mp.gsub! /\n/, ''
  mp.chomp! '='
  mp.tr! '+', '-'
  mp.tr! '/', '_'
  mp
end
@@@

Tomorrow I'll release an updated version of the Multipass gem that
handles all this for you.

Great! Didn't realize that I was on the bleeding edge here :-).
You're an ace. Happy new year.

--dan

Is PHP 5.2 required to pass info to the widget? Seems like I need some kind of special JSON library. Is there any way around this?

You don't need JSON, it's pretty easy to output formatted JSON by hand
I suppose. There's also a pure PHP json lib. But, you do need an AES
encryption library.

http://mike.teczno.com/json.html