Configure LW-SSO in the Service Manager server

Applies to User Roles:

System Administrator

Service Manager servers, version 9.30 and later, support Lightweight Single Sign-On (LW-SSO). A Service Manager integration can pass an authentication token to Service Manager and does not require re-authentication. This simplifies the configuration of Single Sign-On for HPE solutions by removing the need to use Symphony Adapter (which proxies LW-SSO-based authentication with the Service Manager Trusted Sign-On solution).

Enabling LW-SSO in the Service Manager server enables web service integrations from other HPE products (for example, Release Control) to bypass Service Manager authentication if the product user is already authenticated and a proper token is used; enabling LW-SSO in both the Service Manager server and web tier enables users to bypass the login prompts when launching the Service Manager web client from other HPE applications.

Note Existing integrations that use the Symphony Adapter and Trusted Sign-On rather than this new LW-SSO mechanism can continue to work.

To configure LW-SSO in the Service Manager server:

  1. Go to the <Service Manager server installation path>/RUN folder, and open lwssofmconf.xml in a text editor.
  2. Make sure that the enableLWSSOFramework attribute is set to true (default).
  3. Change the domain value example.com to the domain name of your Service Manager server host.

    Note To use LW-SSO, your Service Manager web tier and server must be deployed in the same domain; therefore you should use the same domain name for the web tier and server. If you fail to do so, users who log in from another application to the web tier can log in but may be forcibly logged out after a while.

  4. Set the initString value. This value MUST be the same with the LW-SSO setting of the other HPE product you want to integrate with Service Manager.

Note

  • LW-SSO version 2.5 is supported.
  • Optionally, you can change attributes paddingModeName, keySize, encodingMode, engineName, and cipherType. However, you must make sure that they are same with the LW-SSO setting of the other HPE product that you want to integrate with Service Manager.
  • Do not change the other configurations, such as the content in tag <restURLs>, and the attribute of tag <service>.

Example

<?xml version="1.0" encoding="UTF-8"?>
<lwsso-config xmlns="http://www.hp.com/astsecurity/idmenablmentfw/lwsso/2.0">
  <enableLWSSO enableLWSSOFramework="true"
   enableCookieCreation="true" cookieCreationType="LWSSO" />
    <web-service>
	<inbound>
	  <restURLs>
		<url>.*7/ws.*</url>
		<url>.*sc62server/ws.*</url>
		<url>.*/ui.*</url>
	  </restURLs>
	  <service service-type="rest" >
	    <in-lwsso>
		<lwssoValidation>
		  <domain>example.com</domain>
		 <crypto cipherType="symmetricBlockCipher" engineName="AES"
		  paddingModeName="CBC" keySize="256" encodingMode="Base64Url"
		  initString="This is a shared secret passphrase"</crypto>
		</lwssoValidation>
	    </in-lwsso>
	  </service>
	 </inbound>
	 <outbound/>
   </web-service>
</lwsso-config>