Administer > System Security > SAML Single Sign-On > SAML Single Sign-On setup > Configure IdM authentication in the Service Manager web tier

Configure IdM authentication in the Service Manager web tier

You only need to update the WEB-INF/webtier.properties file to enable HPE Identity Manager (IdM) authentication in the web tier.

To enable IdM authentication in the web tier, follow these steps:

  1. Stop the web application server.

  2. Open the WEB-INF/web.xml file in a text editor, and check that the LW-SSO filter mapping and filter are commented out as shown below.

    Note You must not enable both SAML SSO and LW-SSO for Service Manager. This step will disable LW-SSO.

    <!--
  <filter-mapping>
    <filter-name>LWSSO</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
-->


<!--
  <filter>
    <filter-name>LWSSO</filter-name>
    <filter-class>com.hp.sw.bto.ast.security.lwsso.LWSSOFilter</filter-class>
  </filter>
-->

  3. Open the WEB-INF/webtier.properties file in a text editor, and then specify the following parameters.

    Tip For more information about IdM parameters, see Install and configure the HPE Identity Manager service.

    Parameter Default Description
    idm.sso.enabled false

    Indicates if IdM SSO is enabled. To enable IdM SSO, set this parameter to true.
    idm.tenant N/A

    The tenant in which all Service Manager user accounts will reside. This parameter value must match the tenant configured on the IdM service side.

    Tip For more information, see Install and configure the HPE Identity Manager service.
    idm.token.signingKey N/A

    This is the key used to sign IdM tokens. This parameter value must match the idm.encryptedSigningKey value defined in the \WEB-INF\string\applicationContext.properties file of the IdM service.
    idm.endpoint N/A

    This is the absolute URL of the IdM service. For example: https://localhost:8443/idm-service.

    idm.http.user

    idm.http.password

    N/A

    This is the user account used to access the IdM service.

    These parameter values must match the values of the integrationAcctUserName property and integrationAcctPassword property that are specified in the WEB-INF\spring\applicationContext.xml file of the IdM service.

    idm.ssl.trustAll false Indicates whether to verify that the IdM server certificate is trusted. To verify the IdM server certificate, keep the default value (false).

    idm.truststore

    idm.truststore.password

    		 N/A

    This is the IdM client trust store and password. The IdM client uses this file to validate the IdM server certificate. For more information, see Create an IdM client trust store.

    Note You must specify these two parameters if the idm.ssl.trustAll parameter is set to false.

    isCustomAuthenticationUsed true

    To enable SAML SSO, set this parameter to false.

    Note The web tier configuration file (web.xml) also contains this parameter (default: true). The setting in the WEB-INF/webtier.properties file overrides the setting in the web.xml file.

    The following is an example.

    idm.sso.enabled=true
idm.tenant=IDM-SM
idm.token.signingKey=awscd456!
idm.endpoint=https://localhost:8443/idm-service
idm.http.user=idmTransportUser
idm.http.password=idmTransportUser
idm.ssl.trustAll=false
idm.truststore=/WEB-INF/trustStore.keystore
idm.truststore.password=tomcat1
isCustomAuthenticationUsed=false

  4. Restart the web application server.

    Once the web application server is restarted, the idm.http.password, idm.token.signingKey, and idm.truststore password parameter values are automatically encrypted.

    Note Later when you need to update any of these values, you need to change the old encrypted value to your new value, and then restart the web application server. The new value you have entered is automatically encrypted.

ClosedClick here to show or hide links to related topics.

Related concepts

SAML Single Sign-On

SAML Single Sign-On setup

Send Help Center feedback