Activate single Sign-on (SSO) in the portal
Set up SSO properties by navigating to Admin > Authentication > SSO. Access to Authentication settings are restricted to users with a Super User role. In addition to the SSO properties displayed in the Authentication, a valid SSL certificate must added to the portal keystore. Field descriptions for each of the properties are available through rollover text.
You must have downloaded the SAML metadata XML file from the external Identity Provider (IdP).
Note:
If you are unable to save the configuration, check if the JDK truststore password was changed before the last upgrade and ensure the updated password is assigned to the portal.jdk.trustStore.password parameter from Admin > System Configuration > Custom page of the Portal. The JDK truststore locations for Windows and Linux are <portal_installation_path>\jdk\lib\security\cacerts and /usr/java/lib/security/cacerts respectively.
To activate single sign on in the Portal
- Navigate to Admin > Authentication > SSO.
- On the SSO using SAML page, select Enable SSO to activate SSO.
- Select Enable SSO Authorization if required. Selecting this option activates group memberships from the external LDAP.
The group name derived from the memberOf list must match the name of the User Group.
- Enter AD attribute name in SSO Login Attribute - the value of this attribute serves as an access credential for users during the SSO login.
Note:
After activating SSO, a user performing a local login will have to use this attribute value as a credential to access the Portal.
- Enter the URL for the portal application. This should be an https URL with a trailing '/' at the end of URL.
- Browse to the metadata.xml file that was downloaded from the external Identity Provider (IdP).
- Enter the URL for the external IdP server. The entityId must match the value of entityId as listed in the IdP metadata XML file.
- Enter the domain to be assigned to the SSO user when the Portal creates it automatically.
- Restart the Portal Tomcat service.
Note:
If there are issues with the configuration, your Portal may not restart. There is a utility (resetSSoConfig) available to reset the parameters so the Portal can be restarted.
- Download the metadata XML file using the following URL:
https://aptareportal.domain_name/saml/metadata
If the XML is displayed in the browser, you can select "save target as" to save the XML as a file. This file will be required on the external Identity Provider (IdP) server to identify IT Analytics as a service provider for SSO and complete the registration process.
Note:
The XML file is only available once the configuration settings have been saved and the Portal Tomcat service has been restarted.
- After the registration process is complete, open the Portal login screen and try to login with Single Sign On. If there are issues with the configuration, your Portal may not restart. Use the resetSSoConfig utility to reset the parameters so the Portal can be restarted.
- Navigate to Admin > Advanced > System Configuration > Portal.
