Task 9: Configure the IdM service for LW-SSO compatibility

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Step 1. Specify the IdM tenant for LW-SSO

Once you have specified a tenant in the .json file, you need to specify this tenant in the LW-SSO configuration of IdM.

To specify the tenant for LW-SSO, follow these steps:

Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

Search for the following text to locate the LW-SSO section, which is below this text line:

<lwsso  tenant="Tenant1">

Update the lwsso tag to include the tenant name that you specified in the .json file:

<lwsso tenant="IDM-SM">
      ...
      <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                    paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                    cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                    jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                    pbeCount="20" pbeDigestAlgorithm="SHA1"/>

       ...
</lwsso>

Step 2. Configure LW-SSO settings

You need to specify the domain and initString settings in the IdM service.

To do this, follow these steps:

Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

Check that you have already specified the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

Change the initString value to match the one specified in other applications that will participate in LW-SSO.

<lwsso>
       <!-- crypto is required.
         It defines how to encrypt the tokens and how to decrypt them
	     All inline attributes have default values (denoted here) save initString.
		 initString - is the key for decryption of the lwsso token. This is the shared secret of all servers
		 protected by lwsso and connected to the same authentication point server; therefore, it
		 must be identical in all configurations of all servers in the system.
                (all other values are defaults)
		    -->
            <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                    paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                    cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                    jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                    pbeCount="20" pbeDigestAlgorithm="SHA1"/>

            <!-- Optional tag. however, if configured, then it must be configured on all entities in the system.-->
            <!--
            <sign lookForKeyStoreInClasspath="false" algorithmName="SHA256withRSA" keyStorePassword="topazPwd"
                  privateKeyPassword="mercuryPwd" keyStorePath="C:\MSM" privateKeyDefaultAliasName="lwsso"
                  certificateDefaultAliasName="lwsso" keyStoreName="lwsso" keyStoreType="JKS"
                  providerName="Default Provider Name" />
            -->
 </lwsso>