How secured is SSO based on token based authentication?

Question

I am planning to integrate jasper server with my web application as Single Sign on. I went through Jasper Authentication cookbook and jasper suggest Token based authentication as one of the solution (as authentication is already done by my web application)

What Jasper suggests is this

you pass the token in specific format (as defined below under tokenFormatMapping) to jasper server , jasper will authenticate the request.

So valid tokens can be

   u=user|r=role1|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601

Invalid token can be

   u1=user|r=role1|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601
   r=role1|u=user|o=org1|pa1=PA11|pa2=PA21|exp=2001404150601

My question is this really a secured process because as soon hacker knows the pattern, he can simply login to jasper server ? To me looks like security can be compromised here. Am i missing something here?

<bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.preauth.JSPreAuthenticatedAuthenticationProvider">
 ....................
      <property name="tokenPairSeparator" value="|" />
      <property name="tokenFormatMapping">
        <map>
          <entry key="username" value="u" />
          <entry key="roles" value="r" />
          <entry key="orgId" value="o" />
          <entry key="expireTime" value="exp" />
          <entry key="profile.attribs">
            <map>
              <entry key="profileAttrib1" value="pa1" />
              <entry key="profileAttrib2" value="pa2" />
            </map>
          </entry>
        </map>
      </property>
      <property name="tokenExpireTimestampFormat" value="yyyyMMddHHmmssZ" />
    </bean>
  </property>
</bean>

Answer 1

According to the Jasper Reports Authentication cookbook, using token-based authentication the user is not directly logged in, meaning that only certain operations can be done using this method.

Furthermore, it specifies the following:

JasperReports Server will accept any properly formatted token; therefore, you need to protect the integrity of the token using measures such as the following:

• Connect to JasperReports Server using SSL to protect against token interception.
• Encrypt the token to protect against tampering.
• Configure the token to use a timestamp to protect against replay attacks. Without a timestamp, when you include the token in a web page or REST web service URL, the URL can be copied and used by unauthorized people or systems. Setting the expire time for the token will stop tokens/URLs from being used to authenticate beyond the indicated time. You can set the expiry time depending on your use case. For a user who is logged into the application/portal and is requesting access to JasperReports Server, expiry time of a minute or less from the request time is appropriate.

All communications need to be made through an SSL tunnel. Otherwise, anyone could establish a connection to your JR server, send tokens and get information from it.