SSO Plugin. Installation for BMC Discovery. J System Solutions. Version 5.1

Transcription

1 SSO Plugin Installation for BMC Discovery J System Solutions Version 5.1

2 Introduction... 3 Overview... 3 FAQ... 3 Implementation checklist... 4 Compatibility & prerequisites... 5 Application compatibility... 5 Prerequisite for SSO Plugin... 5 Minimum version... 5 HTTPS... 5 Verifying the SSO Plugin RSSO service is working... 5 Verify your user can already authenticate with SSO Plugin... 6 Prerequisite for BMC Discovery... 7 Network connectivity... 7 LDAP Group Mapping... 7 Testing the group mapping... 8 Configure SSO for BMC Discovery... 9 Testing the solution... 9

3 Page 3 of 9 Introduction This document covers: Compatibility matrix and other introductory material for SSO Plugin. Installation and configuration of SSO Plugin for BMC Discovery. If there are any further questions or queries not found within this document, please feel free to contact JSS Support via support@javasystemsolutions.com The JSS support website can also be found here: Overview The BMC Discovery product is unlike other BMC products with regards to how Single Sign On (SSO) can integrate. The product does not have a flexible SSO interface in which any third party can integrate a solution, and BMC Discovery version 11.1 requires RemedySSO (RSSO). However there are many limitations to this product which hinder customers deploying it, ie requiring its own database; its own separate infrastructure; no data driven user name translation, incomplete SSO integrations (full Windows Authentication implementation) and more. To address these shortcomings, JSS has developed SSO Plugin to accept authentication requests from BMC Discovery by acting as an RSSO endpoint. This means SSO Plugin can behave like RSSO when accepting authentication requests from BMC Discovery. Customers can continue using SSO Plugin and all of its features, without installing and deploying RSSO. Customers can reuse an instance of SSO Plugin already deployed for any other existing application, ie Mid Tier and MyIT/SmartIT. There are still the prerequisites of configuring BMC Discovery to connect directly to LDAP / Active Directory for group permissions and those are instructions are within this document. This is by BMC design, not JSS. FAQ What are the minimum versions of SSO Plugin and BMC Discovery required for this implementation? o SSO Plugin and BMC Discovery 11.1 What prerequisites are there to my existing environment? o SSO Plugin will need to be running the HTTPS scheme (a BMC requirement). o BMC Discovery will require LDAP group mapping (a BMC requirement). Will I have to duplicate domain users within BMC Discovery? o No. Domain users are authenticated then BMC Discovery will cross reference the account with LDAP/AD for the group membership. From there, you map those LDAP/AD groups to your local BMC Discovery groups. This is the only mapping you maintain. Will I have to modify any configuration files within BMC Discovery? o No. Configuration is performed through the BMC Discovery user interface. Is there a non-sso fall back login? o Yes. BMC Discovery provide this for local users such as system:

4 Page 4 of 9 Implementation checklist Here is a checklist that can be followed to implement SSO Plugin for BMC Discovery Verify compatibility versions for SSO Plugin and BMC Discovery. If required, upgrade SSO Plugin to the minimum version that supports RSSO. Verify and if required, modify SSO Plugin scheme to HTTPS. Verify the SSO Plugin RSSO service is working by browsing to and getting a JSON reply Verify a local user, non-sso/domain e.g. system for contingency Configure BMC Discovery LDAP Group mapping. Configure BMC Discovery SSO.

5 Page 5 of 9 Compatibility & prerequisites Application compatibility The following minimum versions are required and have been tested. SSO Plugin 5.1+ (AR System 9.x) BMC Discovery If further versions of BMC Discovery require a specific version of RSSO, then please contact JSS for instructions on how to configure the relevant SSO Plugin RSSO compatibility option. Prerequisite for SSO Plugin Minimum version The above table shows the minimum SSO Plugin version of 5.1+ If you are using SSO Plugin version 4.x and you are using AR System less than 9.x then this implementation will not work. HTTPS BMC Discovery require the SSO endpoint web server to be HTTPS. It will not let you save the configuration if you do not enter an address that is not HTTPS. Screenshot below: Therefore if you are using SSO Plugin within your environment, then please make sure it is running HTTPS scheme. If it isn't then you will find instructions here on page 25: Verifying the SSO Plugin RSSO service is working To verify that the SSO Plugin RSSO service is working, browse to the following: and the reply should look like this: {"serverversion":"9.1.01"} Verify the cookie domain values This value must match the domain name in which your application runs. For example, if a user types into a browser to access Discovery, the conf-cookie-domain must be

6 Page 6 of 9 set to.mycorp.com. You can also set it to mycorp.com if you have multiple applications running within the mycorp.com domain. This value exists on the Mid Tier installed with SSO Plugin. Open the rsso.properties file which by default will be in the following directory: C:\Program Files\Apache Software Foundation\Tomcat 7.0 \webapps\arsys\web- INF\classes\rsso.properties It is recommended that you only change two of these values. The rules for these values are: conf-cookie-domain If you browse to BMC Discovery with then the conf-cookie-domain should be se to.youdomain.com (note the full stop as the first character). conf-cookie-name Full example of the file: conf-cookie-domain=.youdomain.local conf-cookie-name=sso_midtier1 conf-realm-tenant-*=* conf-realm-domain-*=* conf-tenant-domain-*=* rsso.version= Must be a unique value for this SSO Plugin instance and must start with sso underscore, ie. sso_midtier1 If you do not understand how to configure this file, please contact support@javasystemsolutions.com. Verify your user can already authenticate with SSO Plugin The error messages from BMC Discovery are often not clear & concise. Therefore, by ensuring the current logged on user can utilise SSO saves time. Browse to your existing SSO Plugin installation, for example And this should display a successful authentication with green markers on the left hand side of the page.

7 Page 7 of 9 Prerequisite for BMC Discovery The following is from the BMC prerequisite list on their website. The relevant items are listed below. Network connectivity BMC Discovery should have network connectivity to the Active Directory (LDAP) server(s) over TCP port 389 for LDAP and 636 for LDAPS This is because once authentication is complete, BMC Discovery will gather the LDAP/AD group list for that user and match that group to a local group within BMC Discovery to decide which permission or access the user has BMC Discovery should have network connectivity to SSO Plugin on port 443 (HTTPS) for REST calls. Task: Login to BMC Discovery via SSH with user tideway and run the following command: nslookup midtierhostname.yourdomain.com This should reply with the IP address of your Mid Tier fully qualified domain name (FQDN) If there are any errors, try nslookup to other machines. If none reply then check you have the BMC Discovery appliance configured with the same DNS servers as the Mid Tier in /etc/resolv.conf. LDAP Group Mapping The official BMC documentation on configuring LDAP in BMC Discovery can be found here: In the following example: the domain controller is called dc1.mydomain.com. the Bind User (the user who has access to search for other users within AD) is CN=Administrator,CN=Users,DC= mydomain,dc=com. the application login name is the same as the domain name and for that we will use samaccountname. the domain users are within the DN, CN=Users,DC= mydomain,dc=com Server URI Bind User name Search Base Search Template Search Scope Group Mode ldap://dc1.mydomain.com:389 CN=Administrator,CN=Users,DC=mydomain,DC=com CN=Users,DC=mydomain,DC=com (samaccountname=%(username)s) Sub Tree Microsoft Active Directory 1. Click Group Mapping tab. 2. Click Add button. 3. Add your LDAP group name e.g Administrator. 4. Click checkboxes to map BMC Discovery groups e.g. system, admin. 5. Click Apply. This configuration will ensure that when a domain admin logs in, they are given system and admin group permissions within BMC Discovery.

8 Page 8 of 9 Testing the group mapping When the LDAP configuration has been setup, try logging in with the domain user name and password. If this doesn't work, review the BMC documentation before attempting to configure SSO.

9 Page 9 of 9 Configure SSO for BMC Discovery 1. Browse to your BMC Discovery instance and login as system. 2. Click the Administration gear symbol and click Security > Single Sign On link. 3. Click Remedy SSO tab. 4. Supply the following details: RSSO Server URL RSSO Realm ID * RSSO Agent ID discovery 5. Scroll down to Pinned Certificate and click the Get Server Certificate button. 6. Click Pin Certificate. 7. Scroll back up and click the Save button. 8. Scroll down to the bottom and click the Enable button. 9. Note: For self signed certificates on the Midtier, you can ignore the warnings "Certificate does not match URL hostname" and "RSSO support will not work because the appliance is not in the domain...". 10. Verify the status values are green. 11. Logout of the appliance and close all browsers. Testing the solution Open a new browser and navigate to