I wasn't able to implement auto-logon using the API. However when you first enable a user as a Self-Service Portal User, that's best done through the API. If someone knows how to implement auto-logon through the API, I'd like to hear it.

What I did to implement this was to do a post to the actual Self-Service Portal logon screen (the one's users would see), capture the reponse, yank out the redirection URL from the response, and immediately redirect the user with the URL. I use C#.

Here's an example (I didn't try to compile this). This method logs the user in and returns the redirection URL.

private string LoginToSalesforce()
{
string myOrgID = "1234567XXXX"; //Your company's ID
string myUsername = "janedone"; //The self-service user
string myPass = "boo";

string loginDataToPost = "orgId=" + myOrgID + "&un=" + myUsername + "&pw=" + myPass;

//encode data and convert to byte array to send
UTF8Encoding encoding = new UTF8Encoding();
byte[] byteArray = encoding.GetBytes(loginDataToPost);

//Create HttpWebRequest
HttpWebRequest reqSF = (HttpWebRequest) WebRequest.Create("https://ssl.salesforce.com/sserv/login.jsp");
reqSF.Method = "POST";
reqSF.ContentType = "application/x-www-form-urlencoded";
reqSF.ContentLength = loginDataToPost.Length;

//Post the data stream to Salesforce
Stream requestStream = reqSF.GetRequestStream();
requestStream.Write(byteArray, 0, byteArray.Length);
requestStream.Close();

//Get the response data stream from Salesforce
HttpWebResponse respSF = (HttpWebResponse) reqSF.GetResponse();
Stream responseStream = respSF.GetResponseStream();
StreamReader readStream = new StreamReader(responseStream, Encoding.UTF8);
string respHTML = readStream.ReadToEnd();

//Extract URL from other response data. Doing a string search is not the most elegant solution.
//First make sure login was successful
if (respHTML.IndexOf("Invalid username or password.") {

//The URL line we're looking for comes back in the datastream as
//"URL=/sserv/frontdoor.jsp?csssid=xxxxxxxxxxxxxxx&je=0" quotes included

int posBeginURL = respHTML.IndexOf("URL=") + 4; //offset to remove URL=
int posEndURL = respHTML.IndexOf("\"", posBeginURL); //position of the last double quote showing the end of the URL
int lengthURL = posEndURL - posBeginURL;
return "https://ssl.salesforce.com" + respHTML.Substring(posBeginURL, lengthURL); //the full redirection URL
}
else //Login failed
{
return "http://www.mysite.com/myprettyerrorpage.htm";
}