Adding SSO to LDAP

[#1]

Hi,

I configured an LDAP to my BOE 3.1 Server and now I want to add SSO.

When choosing to do so, I am asked "Please configure your SiteMinder settings" with the following properties:

u2022 Policy Server Host

u2022 Accounting Port

u2022 Authentication Port

u2022 Authorization port

u2022 Agent Name

u2022 Shared Secret

I have no idea where to take this data from.

Please assist.

Thanks,

DS

[BasicTek · Accepted solution]

The SSO settings you stumbled on are for siteminder only (3rd party software required). I don't suggest using this method.

Look in the Admin guide for trusted authentication. Since you are using LDAP you will need to provide the SSO method regardless we have nothing built into our software to do this with LDAP. For a much wider array of SSO options you should use the AD plugin.

Regards,

Tim

[Former Member · Accepted solution]

I followed the trusted authentication section in the admin guide, but it is not workingu2026.

Here are some details about the setting that I did:

The guide talked about setting the trusted authentication to the Enterprise Group. Is the guideline valid also for the LDAP, or this is a different story?

I opened the web.xml file, and followed the guidelines to replace the values to the correct ones, but most of the values were already correct.

I chose the USER_PRINCIPAL as the way to retrieve the user name, but except of putting this value in the web.xml I didnu2019t do anything else to ensure that this is the way it should worku2026. What way should I use?

[BasicTek · Accepted solution]

trusted auth assumes that you will be sending a username to us in 1 of 7 methods. To do this you must provide a way to pass usernames to our web/app.

A common scenario...

IIIS authenticates > users redirected by plugin to tomcat > username detected by trusted auth > remote_user option, username and shared secret sent to the CMS for authorization

2nd common scenario

User logs in to siteminder or other portal > user is redirected to tomcat via link in the portal > Portal is configured to hold a value known as sm-user in the browsers HTTP_HEADER. Tomcat receives the redirected user (set to HTTP_HEADER user param is set to sm-user. Username and shared secret sent to the CMS for authorizing

The blue text iindicates components that do not belong to BO (3rd party). In order to use trusted auth you must supply the method of receiving a username. For simplicity of testing another method exists know as query_string. The green text shows where BO (trusted auth) takes over.

3rd scenario - no 3rd party supplied

user hits logon URL on tomcat with username supplied in the URL http: //myserver:port/InfoViewApp/logon/logon.do?myuser=administrator > tomcat is set to query_string and user param = myuser > tomcat passes shared secret (from trustedprincipal.conf) and username to CMS for authorization. User logged into infoview with Administrator

In the last case only components supplied by boe are used (but it's very insecure as any user can change the name in their URL to become administrator) This is why this method is usually just for testing.

Regards,

Tim

[Former Member · Accepted solution]

Hi Tim,

Which of the suggested scenario is better?

I would prefer the 3rd as it sounds more easy and no need of 3rd party. The risk is since everyone can use the link with myuser=administrator? Isnu2019t the user required to supply a password at the first login? If it is, then it is not so unsafeu2026.

DoronS

[BasicTek · Accepted solution]

trusted auth is logon from trusted source withouit a password, as stated query_string is used for testing because no real secureity can be applied when any user can simply change their logon name in the url, but to get things wroking and try to understand TA better that's a good place to start.

Regards,

Tim

[Former Member · Accepted solution]

Hi Tim,

we are have been asked to implement the Second Scenerio that is mentioned by you. we have few questions regarding that.

1) Could you please elaborate on this in more detail .

2) Does this involve modification to the Infoview's Logon page ?

Environment:

BOXI 3.0 on RHEL , Infoview and CMC on Weblogic server. and we are planning to implement SSO from a portal which will have infoview as one of the applications. Portal has siteminder and Ldap for authentication.

[BasicTek · Accepted solution]

 1) Could you please elaborate on this in more detail .
2) Does this involve modification to the Infoview's  Logon page ?
> BOXI 3.0 on RHEL ,  Infoview and CMC on Weblogic server. and we are planning to implement SSO from a portal which will have infoview as one of the applications. Portal has siteminder and Ldap for authentication.

1) yes

2) no

so users get authenticated on the portal where they should pick up smuser in the HTTP header

you need to set up infoview (via web.xml) for trusted auth

sso.enabled value to true

siteminder to false

trusted.auth.user.retrieval to HTTP_HEADER

trusted.auth.user.param to smuser

create a TrustedPrincipal.conf with shared secret

save in your install root directory or equivalent to win32_x86 on windows

go to enterprise tab in the CMC > Authentication

enable trusted auth

set your shared secret (to be the same as the file)

restart tomcat and test it out with note 1305125 - XI 3.x Trusted Authentication test script used to verify usernames being passed to the web application server

You should also be on 3.1 if possible, all though basic trusted auth will work on 3.0

Regards,

Tim

[Former Member · Accepted solution]

Thank you Tim, I have few more questions , regarding the above suggestions.

1) What will happen when a New user who is in LDAP but his name not in BOXI enterprise tries the BO Link from a Portal. Will the BOXI create a New account for him?? or give him an error !! How does BOXI know that he is authorized to access BOXI !.

(Guest Account would is Always Turned OFF ?)

2) How is the User Synch happen between BO Enterprise and LDAP. In what way will the above implementation impact the Synch between LDAP and BO Enterprise.

3) Correct me if am Wrong, i believe if i have LDAP auth with Siteminder, then BO will create a (alias) account in BO enterprise for all those accounts present in LDAP . am i right ?

Regards,

Ram G

[BasicTek · Accepted solution]

>

> Thank you Tim, I have few more questions , regarding the above suggestions.
> 
> 1) What will happen when a New user who is in LDAP but his name not in BOXI enterprise tries the BO Link from a Portal.  Will the BOXI create a New account for him??  or give him an error !!  How does BOXI know that he is authorized to access BOXI !.
> (Guest Account would is Always Turned OFF ?) 
> 
> 2) How is the User Synch happen between BO Enterprise and LDAP.  In what way will the above implementation impact the Synch between LDAP and BO Enterprise.
> 
> 3) Correct me if am Wrong, i believe if i have LDAP auth with Siteminder, then BO will create a (alias) account in BO enterprise for all those accounts present in  LDAP . am i right ?
> 
> Regards,
> Ram G

1) no they will fail to login. With trusted auth you must create the user. At the core of this technology all our system does is look up usernames passed via 1 of the 7 methods available. If the username is not there we cannot create it or there would be no way to restrict anyone from getting into the BO system.

2) You can map in groups from LDAP and manually update the plugin to bring in users or schedule SDK code to do it for you. For the SDK code check note 1296101. to note SP2 should be out and it was supposed to contain an enhancement so you can schedule LDAP updates. I haven't tested yet but this should be available now or very soon.

3) True but this is a legacy plugin that limits your siteminder to 1 web agent and it must be v6 only. going forward trusted auth will be the preferred method to immigrate with siteminder. In the future we may have an enhancement for creating users but I'm not sure when.

For the best SSO solutions most of our customers make use of existing AD infrastructure. If that is not possible then we do offer LDAP and trusted auth for everyone else but the features/functionality can be limiting at times.

Regards,

Tim

3)

[Former Member · Accepted solution]

Hi Tim,

1) Why not use the SSO with siteminder settings as suggested in SITEMINDER Page of the LDAP Configuration wizard? i am asking this because you have suggested me to make changes in web.xml where siteminder from true to false. ( in effect, you have suggested me , to use trusted authentication instead of SSO that is available with siteminder ).

2) Is there any difference between SSO with Siteminder and Trusted authentication as suggested by you above. IF it is , then what is the difference, and why not use the SSO with siteminder ( in BOXI 3.0) for single sign on, wont it work ?

3) I dont know how i could get those notes that you are talking about , can you update the link in this thread or let me know where i should be searching that.

I am bit confused as to why we should use trusted authentication, when there is an option for SSO with siteminder in the LDAP configuration page.

Regards,

Ram G

[BasicTek · Accepted solution]

You can use the siteminder plugin but as stated earlier 1 webagent period, and 6.x is the supported version. it can still create users. Any documentation for siteminder setup you need to seek from CA. The difference is trusted auth doesn't have the above limitations(webagent or version) it but cannot create your users on the fly. Trusted auth is the preferred method going forward. There hasn't been much changed in the siteminder plugin in a while and usually customers need more than 1 web agent configured or other versions other than 6. If neither of these is an issue then you can use the sm plugin.

You must have an s-user ID and login to SMP the note links are no longer public.

Regards,

Tim

[Former Member · Accepted solution]

Thankyou Tim,

That solved my last question as well..

we will most probably settle with Trusted Authentication. If so , then we would have to see how we can synch users from LDAP to BO Enterprise.

Any pointers in that direction would be much appreciated.

I got the NOTE..from SMP ..Thank you.

regards,

Ram G

Edited by: Ramkumar Govindasamy on Jul 28, 2009 2:01 PM

[Former Member · Accepted solution]

Hi ,

Few more questions .

LDAP Integration:

1) If we Configure LDAP with BOE and do not use SSO , then does the Synching of Users between LDAP and BOE is dynamically taken care of BOXI?? i.e Does boxi take care of updating the Users from LDAP to BO Enterprise automatically ?

2) In LDAP Configuration Wizard there is an option for the users to be created after clickin the finish button of the wizard

"New aliases will be added and new users will be created". Does this mean that , in future when a new user attempts to log in using his credentials in infoview, it would fail.! Because it was not done initially ?

Can't i initially populate all the users from LDAP to BO Enterprise and then allow for adding the new future users whenever they login for the first time?

3) Is there any option on CMS (say a action button,), so that administrator can synch the users when required ?

(I did see the UPDATE button on Admin GUIDE, is that the one used for updating the users).

SSO using Siteminder:

1) Is it one web agent for a CMC or is it one web agent for an Infoview installation i.e what if i want to have two Lines of Business using LDAP and Siteminder for SSO in the a Shared CMC environment.

Regards,

Ram G

[BasicTek · Accepted solution]

>

1)* If we Configure LDAP with BOE and do not use SSO , then does the Synching of Users between LDAP and BOE is dynamically taken care of BOXI?? i.e Does boxi take care of updating the Users from LDAP to BO Enterprise automatically ?
2)* In LDAP Configuration Wizard  there is an option for the users to be created after clickin the finish button of the wizard
 "New aliases will be added and new users will be created".  Does this mean that , in future when a new user attempts to log in using his credentials in infoview, it would fail.!  Because it was not done initially ?
Can't i initially populate all the users from LDAP to BO Enterprise and then allow for adding  the new future users whenever they login for the first time?
3) Is there any option on CMS (say a action button,), so that administrator can synch the users when required ?
(I did see the UPDATE button on Admin GUIDE, is that the one used for updating the users).
SSO using Siteminder:
1) Is it one web agent for a CMC or is it one web agent for an Infoview installation i.e  what if i want to have two Lines of Business using LDAP and Siteminder for SSO in the a Shared CMC environment.

1) the ONLY advantage of using the siteminder plugin over trusted auth is users get created when they login (if not already so) it offers nothing else in respect to how the LDAP plugin works or synchronizing user accounts.

2) no with siteminder configured any user that belongs to a mapped group will always be created, this button deals with the behavior after hitting the update button in the LDAP plugin only

3) Only AD has that feature already if you want to automate it in LDAP then SDK scripts can be used.

1) 1 web agent period because the plugin has only 1 field to enter the web agent name. Siteminder will not allow multiple web agents of the same name + the agent must be running in 4x compatibility mode and a shared secret must be used. (told you this was not a desirable configuration).

Regards,

Tim

[Former Member · Accepted solution]

Hi Tim,

I have implement the Trusted Authentication as discussed above

User Retrieval = "Http_Header"

User Param = "smuser"

Also i have implemented the note, for checking the retrieval of the user.

Testing:

i login into the Portal with my user id an d after sucessful login , in the same browser i paste the infoview url, (since i dont have the infoview link in the portal)

am i doing the correct way of testing this ?

The authentication check jsp page displays that the smuser id from http header is null !

Error message: User id not recognized, disabled etc.

Is my way of testing wrong ?

Regards,

Ram G

Edited by: Ramkumar Govindasamy on Aug 3, 2009 4:29 PM

[BasicTek · Accepted solution]

Maybe your siteminder isn't using the variable smuser or it's sm_user or sm-user. I've seen all 3 and sometimes siteminder admins change it all together to something completely different. You can open a case with support and have an engineer dig in with somo other scripts we have or using a tool like fiddler to see.

Regards,

Tim

[Former Member · Accepted solution]

Hi Tim,

we are going to have a distributed architecture, so that the Presentation tier (infoview,cms, etc)will be placed in a seperate webserver. In such case, where do i place the trustedprinciple.conf file ? I believe we will not have thie winx_86 folder for presentation tier installations. Correct me if am wrong ?

How do Business Objects presentation tier know, where to pick up the shared secret? Do we have some placeholder value,which might hold the location of the trustedprinciple.conf file.

Thank you for your continued support!

Regards,

Ram g

[BasicTek · Accepted solution]

the trustedprincipal.conf has to be readable from the web/app which will pass the sharedsecret value defined in that file with the suername defined in the trusted auth settings of the web.xml to the CMS (the enterprise plugin will also have the shared secret entered for verification)

Regards,

Tim

[Former Member]

Hi,

I have an application in .NET that uses Web Services SDK, and I would like to use Trusted Authentication.

Is it possible? If It is, what are the steps to configure BO and the code in .NET?

Thanks,

Sandra

[BasicTek]

What method of authentication are you using? And how do you plan to pass the username to BO?

Regards,

Tim

[Former Member]

We have just configured our BO server to use Trusted Authentication (REMOTE_USER) and It works!. We can access to InfoView directly.

We are trying that our .NET application (that uses Web Services SDK) connects to BO without passing user and password.

Before the configuration, we were using this code:

BusinessObjects.DSWS.Connection oConnection = new BusinessObjects.DSWS.Connection(m_strURL);

BusinessObjects.DSWS.Session m_wiSession = new Session(oConnection);

BusinessObjects.DSWS.Session.EnterpriseCredential oEC = new EnterpriseCredential();

oEC.Login = strLogin;

oEC.Password = strPassword;

oEC.AuthType = "secLDAP";

SessionInfo oSI = m_wiSession.Login(oEC);

In this case, we need the user and password to authenticate. Now that Trusted Authentication is configured, we don't know what code use to authenticate without a password.

I would appreciate your reply.

Thanks,

Sandra

[BasicTek]

REMOTE_USER depends on IIS integrated authentication, the authenticator that I keep asking you for. If you have this enabled on your .net application trusted auth should pick it up.

Regards,

Tim

[Former Member]

I have configured my .net application to use Windows credentials.

But What code should I use? (with Web Services SDK)

Thanks,

Sandra

[BasicTek]

You are in the BO administration forum, if you have SDK questions you should query the appropriate SDK forum. for a link see the sticky post at the top of this forum.

Regards,

Tim