Administer > System security > SAML Single Sign-On > SAML SSO setup > Configure SAML SSO using the standalone IdM > Task 6: Configure the IdM service for LW-SSO compatibility

Task 6: Configure the IdM service for LW-SSO compatibility

Caution If you skip this task, SAML SSO is not compatible with the legacy LW-SSO solution.

Step 1. Specify the IdM tenant for LW-SSO

Once you have specified a tenant in the .json file, you need to specify this tenant in the LW-SSO configuration of IdM.

To specify the tenant for LW-SSO, follow these steps:

  1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.
  2. Search for the following text to locate the LW-SSO section, which is below this text line:

    <lwsso  tenant="Tenant1">
  3. Update the lwsso tag to include the tenant name that you specified in the .json file:

    <lwsso tenant="IDM-SM">
          ...
          <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                        paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                        cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                        jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                        pbeCount="20" pbeDigestAlgorithm="SHA1"/>
    
           ...
    </lwsso>

Step 2. Configure LW-SSO settings

You need to specify the domain and initString settings in the IdM service.

To do this, follow these steps:

  1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.
  2. Check that you have already specified the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

    Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

  3. Change the initString value to match the one specified in other applications that will participate in LW-SSO.

    <lwsso>
           <!-- crypto is required.
             It defines how to encrypt the tokens and how to decrypt them
    	     All inline attributes have default values (denoted here) save initString.
    		 initString - is the key for decryption of the lwsso token. This is the shared secret of all servers
    		 protected by lwsso and connected to the same authentication point server; therefore, it
    		 must be identical in all configurations of all servers in the system.
                    (all other values are defaults)
    		    -->
                <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                        paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                        cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                        jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                        pbeCount="20" pbeDigestAlgorithm="SHA1"/>
    
                <!-- Optional tag. however, if configured, then it must be configured on all entities in the system.-->
                <!--
                <sign lookForKeyStoreInClasspath="false" algorithmName="SHA256withRSA" keyStorePassword="topazPwd"
                      privateKeyPassword="mercuryPwd" keyStorePath="C:\MSM" privateKeyDefaultAliasName="lwsso"
                      certificateDefaultAliasName="lwsso" keyStoreName="lwsso" keyStoreType="JKS"
                      providerName="Default Provider Name" />
                -->
     </lwsso>