Set up trusted sign-on (TSO)

Trusted sign-on (TSO) or Single sign-on is an optional Mobile Applications configuration that relies on a working SSL configuration, and integration with a trusted authentication source such as CA SiteMinder, IBM Webseal, and Integrated Windows Authentication. It also requires a web server to accept the pre-authenticated HTTP header information from your authentication source.

For more information, refer to Setting up Single Sign-on in Service Manager.

When you enable trusted sign-on (TSO), Mobile Applications will used the username of the user represented by the Principal to bypass the Service Manager log-on screen, and then enter the application directly.

Enable TSO on the Service Manager server

In the sm.ini file, add the following parameter:

trustedsignon:1

For detailed information, refer to Setting up Single Sign-on in Service Manager.

Enable TSO on the Mobile Applications client

To enable TSO on the Mobile Applications client, follow these steps:

1. Open webapp-9.60.xxxx.war in an archive management program.
2. Extract the web.properties file from the WEB-INF directory to your local system, and then open this file in a text editor.

3. Locate the isCustomAuthenticationUsed script and set the value to false:

   # Set false to enable Trusted Sign-on
   isCustomAuthenticationUsed=false

4. Save the file and add the updated file back to the WEB-INF directory of the webapp-9.60.xxxx.war archive.
5. Extract the security.xml file from the WEB-INF/spring directory to your local system, and then open this file in a text editor.

6. Locate the following scripts:

   <!-- <security:custom-filter ref="preAuthenticationFilter" after="SECURITY_CONTEXT_FILTER"/>
       <security:custom-filter ref="lwSsoFilter" before="BASIC_AUTH_FILTER"/>
       <security:custom-filter ref="springSecurity2lwssoIntegrationFilter" position="LAST"/> -->
   

   Uncomment the first line as follows to enable TSO:

   <security:custom-filter ref="preAuthenticationFilter" after="SECURITY_CONTEXT_FILTER"/>
       <!--  <security:custom-filter ref="lwSsoFilter" before="BASIC_AUTH_FILTER"/>
       <security:custom-filter ref="springSecurity2lwssoIntegrationFilter" position="LAST"/> -->
   

   Or,

   For HTTP header pre-authentication, locate the following scripts and uncomment it:

   <!--<security:custom-filter ref="httpHeaderPreAuthenticationFilter" after="SECURITY_CONTEXT_FILTER"/>-->

7. Locate the httpHeaderPreAuthenticationFilter bean definition, and then at least change the principalRequestHeader setting, corresponding to the Header your Identity Management solution uses. For Webseal, iv-user is used as the value of principalRequestHeader, Siteminder often uses sm_user or sm_universalid. Note that this setting is case sensitive.

8. Save the file and add the updated file back to the WEB-INF/spring directory of the webapp-9.60.xxxx.war archive.
9. Configure the deployment environment to support the mobile system to receive the customized user information for authentication.