Administer > System security > Trusted sign-on > Requirements for trusted sign-on

Requirements for trusted sign-on

This configuration is intended for customers who have an Service Manager server running in a secured environment and want users to be able to log on to the server without providing a user name and password.

Parameters required in the server configuration file (sm.ini)


Parameters required in the web tier configuration file (web.xml)

isCustomAuthenticationUsed – Set the value to false to make Service Manager send the current user name in the HTTP header.

Other requirements

  1. Configure your web application server to use a trusted authentication source.
    1. Stop the web application server running the web tier.
    2. Navigate to the folder <web tier installation path>\WEB-INF\classes, and open the file application-context.xml in a text editor.
    3. Search for the following string:

      <sec:filter-chain pattern="/**" filters="securityContextPersistenceFilter,anonymousAuthFilter"/>

    4. Replace the search string with the following text to use Microsoft Integrated Windows Authentication as your trusted authentication source:

      <sec:filter-chain pattern="/**" filters="securityContextPersistenceFilter,preAuthenticationFilter,anonymousAuthFilter"/>

    5. Save the file and restart the web application server.
  2. Create an operator record for each Windows user that you want to log on to Service Manager. These operators do not need a password.
  3. Install and configure an external authentication source, such as Microsoft Integrated Windows Authentication, to ensure that Service Manager can use your private certificates.
  4. Beginning with Service Manager 9.30, Trusted Sign-On (TSO) requires the use of ssl_reqClientAuth:2. You must create unique client SSL certificates for each Service Manager client that needs to access Service Manager with TSO. For example, if you have 20 Windows clients, you must create 20 unique client SSL certificates. If you have four Service Manager Web Tier servers, you must create four unique client SSL certificates.

    Tip If maintaining these unique client SSL certificates incurs unsustainable IT operation costs, you can consider the use of the acceptsharedcert:1 parameter. See Parameter: acceptsharedcert.

Related topics

Example: Enabling trusted sign-on
Example: Generating a client certificate with OpenSSL
Example: Generating a server certificate with OpenSSL

Related topics

Add a client certificate to the web tier
Add a client certificate to the Windows client
Update the cacerts keystore file

Related topics

Requirements for required SSL encryption
Requirements for required SSL encryption and client authentication
Requirements for required SSL encryption and trusted clients
Parameter: acceptsharedcert