Searching the Help
To search for information in the Help, type a word or phrase in the Search box. When you enter a group of words, OR is inferred. You can use Boolean operators to refine your search.
Results returned are case insensitive. However, results ranking takes case into account and assigns higher scores to case matches. Therefore, a search for "cats" followed by a search for "Cats" would return the same number of Help topics, but the order in which the topics are listed would be different.
Words and Phrases
| Search for | Example | Results |
|---|---|---|
| A single word | cat
|
Topics that contain the word "cat". You will also find its grammatical variations, such as "cats". |
|
A phrase. You can specify that the search results contain a specific phrase. |
"cat food" (quotation marks) |
Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase. |
Using Boolean Operators
| Search for | Operator | Example |
|---|---|---|
|
Two or more words in the same topic |
|
|
| Either word in a topic |
|
|
| Topics that do not contain a specific word or phrase |
|
|
| Topics that contain one string and do not contain another | ^ (caret) |
cat ^ mouse
|
| A combination of search types | ( ) parentheses |
|
- Install and configure the standalone IdM service
- Task 1: Deploy IdM on a web application server
- Task 2: Configure SSL in the IdM web application server
- Task 3: Create an IdM client trust store
- Task 4: Configure SAML SSO
- Task 5: Configure a tenant and specify the ADFS metadata URL
- Task 6: Configure the IdM service for LW-SSO compatibility
- Task 7: Specify an IdM token signing key
- Task 8: Specify an IdM user account for Service Manager
- Task 9: Replace JRE policy files for the IdM server
- Task 10: Configure the SAML keystore in IdM
- Task 11: Import the IdP public key into the IdM SAML keystore
- Task 12: Encrypt IdM passwords and keys
- Task 13: Create an empty database for IdM
- Task 14: Configure database connection in the IdM service
- Task 15: Download the IdM metadata
- Task 16: Create a trust relationship with ADFS
- Task 17: Adjust the max authentication age setting in the IdM service
- Configure SAML authentication by using the IdM admin console
Task 6: Configure the IdM service for LW-SSO compatibility
Caution If you skip this task, SAML SSO is not compatible with the legacy LW-SSO solution.
Step 1. Specify the IdM tenant for LW-SSO
Once you have specified a tenant in the .json file, you need to specify this tenant in the LW-SSO configuration of IdM.
To specify the tenant for LW-SSO, follow these steps:
- Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.
-
Search for the following text to locate the LW-SSO section, which is below this text line:
<lwsso tenant="Tenant1">
-
Update the lwsso tag to include the tenant name that you specified in the .json file:
<lwsso tenant="IDM-SM"> ... <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES" paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled" cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1" jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac" pbeCount="20" pbeDigestAlgorithm="SHA1"/> ... </lwsso>
Step 2. Configure LW-SSO settings
You need to specify the domain and initString settings in the IdM service.
To do this, follow these steps:
- Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.
-
Check that you have already specified the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.
Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.
-
Change the initString value to match the one specified in other applications that will participate in LW-SSO.
<lwsso> <!-- crypto is required. It defines how to encrypt the tokens and how to decrypt them All inline attributes have default values (denoted here) save initString. initString - is the key for decryption of the lwsso token. This is the shared secret of all servers protected by lwsso and connected to the same authentication point server; therefore, it must be identical in all configurations of all servers in the system. (all other values are defaults) --> <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES" paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled" cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1" jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac" pbeCount="20" pbeDigestAlgorithm="SHA1"/> <!-- Optional tag. however, if configured, then it must be configured on all entities in the system.--> <!-- <sign lookForKeyStoreInClasspath="false" algorithmName="SHA256withRSA" keyStorePassword="topazPwd" privateKeyPassword="mercuryPwd" keyStorePath="C:\MSM" privateKeyDefaultAliasName="lwsso" certificateDefaultAliasName="lwsso" keyStoreName="lwsso" keyStoreType="JKS" providerName="Default Provider Name" /> --> </lwsso>
