AUTHENTICATION - ATRIUM SSO

Transcription

1 Truesight Installation AUTHENTICATION - ATRIUM SSO All Truesight Components depend on Atrium SSO for Authentication. Prior to installing anything, Atrium SSO must be installed and configured. Contents Pre-configuration Requirements Atrium SSO Installation Atrium SSO LDAP Configuration ASM Admin Account 2012 SEI 1

2 Pre-Configuration Requirements Network Configuration 1. Authentication: In production Atrium SSO queries SEI s Corp domain for credentials using LDAP. a. Network Firewall Ports Opened: i. TCP Port 389 opened from <SSO_Server> to <Domain Controller b. LDAP Reader Domain User: Ensure the documented user <LDAP_USER> is available with the documented password. If not you will need to create and document a new one. 2. Proxy: The URL for authentication needs to be configured on the Middleware Trust DMZ Apache Proxies. a. DNS Entries: <SSO_FQDN needs an entry pointing to <Atrium_IP>. b. Network Firewall Ports Opened: i. TCP Port 443 opened from the T-DMZ Apache Servers to the <ATRIUM_SSO_HOST>. System Configuration 1. Atrium requires that Remote Desktop Temporary Folders be disabled. a. Open the RUN command and type regedit. b. Navigate to: HKLM/System/CurrentControlSet/Control/Terminal Server c. Set the following: i. PerSessionTempDir = 0 ii. DeleteTempDirsOnExit = SEI 2

3 Atrium SSO Installation After the above pre-configurations are complete, locate the installer for Atrium SSO v Right-click setup.exe and select RunAs Administrator. a. The installer goes through a pre-installation checklist. If there are no errors you will be presented with the following. Click Next. 2. Agree to the legal mumbo-jumbo and click Next SEI 3

4 3. On the Feature Selection window, select Install BMC Atrium Single Sign-On and click Next. 4. Set the Destination Directory to E:\AtriumSSO and click Next: 5. Enter the FQDN of the URL used when accessing Truesight from app owner workstations and click Next: 2012 SEI 4

5 6. Select Non-Clustered on the Cluster Options screen and click Next: 7. Select Install New Tomkat on the Tomkat App Server Selection screen and click Next: 8. Set the HTTPS Port number to 443 and leave the admin port as default. Click Next: 9. Keep the Cookie Domain as <FQDN_Cookie_Domain> and click Next: 2012 SEI 5

6 10. Set the Atrium SSO Administrator account to the documented account password and click Next: 11. Confirm options on Installation Preview and click Install: 2012 SEI 6

7 12. Process takes about 5-10 minutes: 13. If installation completed successfully you will see the following screen. You can view the log if any errors appeared. Click Done after reviewing SEI 7

8 Atrium SSO LDAP Configuration Considerations when configuring Atrium SSO for Truesight : 1. If there are multiple application groups access Truesight Presentation, it will be well worth your while to either: a. Create new directory groups that fit a specific naming convention. b. Ensure you don t select groups that are extremely broad such as Domain Users. Create many search filters to get only the groups you need. TSPS and Atrium SSO are very inefficient. 2. There can be massive delays if you set your LDAP search base too high and you have a large directory, you won t be able to enumerate accounts or groups as it will just time out. Atrium SSO doesn t perform any sync action and caches the data, it enumerates as needed. 3. TSPS is limited by the Max Search Results. This is probably the most important. If your max search results are set to 100 but you have 101 accounts that you need access to, TSPS won t see anything above the 100. a. This is incredibly important as you need to set your Search Filter and Search Base DN to be as granular as possible. 4. In Atrium SSO you can create as many User Stores as needed to account for users or security groups in different SSOs. a. NOTE: Attributes are case sensitive. b. Every user or group within an LDAP or Active Directory Store has Attributes associated with it. Open any user in Active Directory and click the Attributes tab (most domains allow any Domain user to view attributes). Those are the attributes you reference for search attributes: c. Key attributes most often used in search filters: i. samaccountname: Sort of the NetBIOS name of user accounts. Just the username nothing else. ii. distinguishedname (DN): This is the full path to a user account and can include the user account name. The DN is also the path in the Search Base. iii. cn (canonicalname): This is the User Friendly name (or Full Name) SEI 8

9 iv. userprinciaplname (UPN): This is the fully qualified domain name for a user. This can be useful to ensure that bob@aol.com is very different than bob@microsoft.com. There can be only one. v. There are many other attributes, but those are the most common used for user / group filters. d. Search filters are your friend. You can search Google for examples of LDAP queries. Some examples: i. Group Search Filter: ( (cn=application Group*)) 1. This search filter will look for any group whose cn starts with Application Group. ii. Many group search filter: ( (cn=application Group*)(Bob s Group)(Full*)) 1. Similar to the other filter, this now adds an OR to the enter filter. iii. User Search Filter: You are looking at the similar type of filter queries with users. 1. Let s say you have an administrative group that suffixes their standard usernames with something like admin. You could do the following: a. Search Attribute: samaccountname b. Search Filter: (samaccountname=*-admin) e. There are many more examples, but that will get you started with witling down your results to speed up SSO. f. Create Multiple User Stores to narrow the results. So if your security groups are separated in your domain to one OU AND have a similar naming convention, create a store targeting that. i. Example: We custom created a bunch of groups specifically for TrueSight and put users in those. We can leverage the naming convention of that (such as prefixing with TrueSight). ii. BUT: TrueSight isn t smart enough when it comes to Authorization to limit the groups a member is a part of so don t go crazy because BMC still needs to improve the TrueSight filtering side of things. Once installation is complete, we are ready to configure the LDAP connection to <target_domain> SEI 9

10 1. Click the BMC SSO Administration icon from start to open the Admin Interface: 2. The browser opens to the admin URL: 3. The default admin username is amadmin and the password is the documented Administration Password. Enter it and log in. 4. You are presented with the Admin Console. Click the /BmcRealm realm to open the Realm Editor and start configuring LDAP: 5. Add under Realm Authentication and click LDAP / Active Directory: 2012 SEI 10

11 6. The LDAP / Active Directory Editor window opens up with various fields to populate. Fill in the fields with the following information (and based on the below screenshot): a. Primary LDAP Server: i. Name: <target_dc> ii. Port: 389 b. User Account for Search: i. Distinguished Name: <DN_Of_LDAP_Reader> ii. Password: see ASM Password Document c. DN to Start Search: i. Base DN: <target_domain_dn> ii. Attribute for User Profile Name: samaccountname d. Attributes for User Search: i. Attribute Name: samaccountname e. Advanced Tab: Not Used. 7. Click Save when the above fields are populated. 8. We now configure the User Store where Atrium reads account data from SEI 11

12 a. In the lower-right of the Realm Editor, you will see an entry called embedded of type Internal LDAP. Do not delete). b. Click Add and select LDAPv3 User Store: c. In the LDAPv3 (Active Directory) User Store Editor, enter a notable name then fill in the following fields on the General Tab: i. LDAP Server: 1. Name: <target_dc> 2. Port: 389 ii. User Account for Search: 1. Distinguished Name: <DN_LDAP_Reader> 2. Password: Documented ASM LDAP Reader password. iii. Attribute Mapping. This maps the Active Directory username attribute to the Atrium SSO username attribute: 1. External Attribute: samaccountname 2. Atrium SSO Attribute: User ID 3. Click Add d. Click the Search Tab then fill in / modify the following fields: i. Search Base DN: <DN_of_Search_Base> 1. If your users / groups are located in a sub-ou of the directory, use the DN of that Sub-OU SEI 12

13 ii. Max Search Results: Change to 25 (from 1000). iii. Users: 1. Search Attribute: samaccountname 2. People Container: Deselect Enable. e. Click Save 9. The Realm Editor screen should now have an LDAP realm authentication and CORP_LDAP User Store. 10. Make sure the User Profile is set to Required. 11. Repeat the process for more granular user / group containers. 12. You should now be able to click the Users tab at the top of the Realm Editor screen and a list of 25 users from <Target_Domain will show up: 2012 SEI 13

14 a. In the Filter field, enter your CORP username and click Filter. If it is fully set up correctly, it should list your name: 13. You can also click on the Groups tab to see an initial list of CORP groups: 14. LDAP is now configured for Atrium SSO SEI 14

15 ASM Admin Account After the configuration, we need to add a <group_admin> user with the documented password as we never use the built-in accounts. This will be added to the TSPS Administrator group that gets created when the Presentation Server is installed. 1. From the Realm Editor for /BmcRealm click the Users tab. 2. Click Add to open the User editor a. NOTE: this does not create a user in <target> ActiveDirectory but in the embedded user store. b. Enter the following in the User Editor: i. User Id: <username> ii. First Name: First Name iii. Last Name: Last Name iv. Full Name: Full Name v. Password: Documented password from ASM doc. vi. No other fields required. c. Click the Groups Tab. i. Select the BmcAdmins group then click Add. It will then appear under Member Of. 1. Note: The Administrator group might not exist yet. That is part of the TSPS installation SEI 15

16 d. Click Save. e. It should now appear in the Users List along with the Corp users SEI 16