SSO

[Les_G_]

I am looking for documentation on how to configure SSO for a backend application which will require the same credentials as AD for user login. Users will authenticate through the SA and should be automatically login to application without having to click on a bookmark.

First thing, is this possible and could someone point me to the relevant documentation.

Thanks.

[zanyterp_]

Thank you.
When you do a policy trace (Maintenance > Troubleshooting > User Sessions > Policy Tracing) for POST, does the policy show as applying? If yes, it typically (85%+ of the time) means that either the values are incorrect/missing something or the POST URL is incorrect. If the post is done inside JavaScript rather than HTML, the SSO policy will not work as there is no set URL for it to POST against.

If you take a session record (dsrecord) of a user logging in WITHOUT the SSO policy defined, you can save that file and look at the text for the line that starts with POST. You will see the URL that accepts the POST as well as the values that are needed.

[zanyterp_]

Unfortunately, I am not sure at this point.
when you login directly, do you need to include the domain in the username?
some other values to try for the username could be:



domain\

[michael.saw_]

Hope there's an doc to configure SSO in MAG...

[Les_G_]

I have SSO form POST configured and link setup under Users > User Roles > roleName > General > UI Options, custom start page. When I log in it does take me to the page but login credentials are not pass along to the login page of the application. I can get the redirection fine no problem when I login but no form post.

I am using local system for authentication and the remote application is also configured to use the same username and password.

Unders SSO Form POST details I have Post to URL configured with the login page of the application and as the post values I have name I got form the site source as strUsername and value as username strPassword and value as password. Not sure if this is correct way to do it but the help page is not much help in that area.

[Les_G_]

Thanks!

I am seeing the policy applied and have look at the dsrecord and used the values there, tried every combinations and still cannot get SSO to work.

This is what tracing shows:

Applying Policy [OXPLIVE]... 
Action [POST] is returned 
Policy [OXPLIVE] applies to resource 

Dsrecord:

 <form action="" method="post" name="frmLogin">
                <input name="numSubmit" id="numSubmit" type="hidden" value="1">
                <input name="strPageReturn" id="strPageReturn" type="hidden" value="/Index.cfm">
                <input name="strParams" id="strParams" type="hidden" value="">
                <table width="100%"  border="0" cellspacing="0" cellpadding="3">
                  <tr>
                    <td><b>Username:</b></td>
                    <td><input name="strUsername" type="text" id="strUsername" size="29" maxlength="20"></td>
                  </tr>
                  <tr>
                    <td><b>Password:</b></td>
                    <td><input name="strPassword" type="password" id="strPassword" size="29" maxlength="20"></td>
                  </tr>
                  <tr>
                    <td colspan="2" class="login-button">
                      <input type="submit" name="btnSubmit" value="Login" title="Login" class="button">
                    </td>
                  </tr>
                  </table>
                </form>

[Les_G_]

Ok thanks.

no I don`t have to use the domain. I am using a local username created on the SA.

[Les_G_]

Thanks!

I got it working, besides the submit button there was other post info on the page I had to enter. Thanks again.

I have one other question concerning the redirected login page. I am seeing a logut button both for the site and Juniper.

Is there anyway to not show the Juniper log out button. I have check documetnation and SA itself and do not see a way to do this.

[SVK_]

Hi Les_G,

SSO can be configured on the SA. the information required is

1. What is the backend application?

2. What type of SSO are you trying to configure

Kerberos\NTLM\form post.

Regards,

SVK

[Les_G_]

Thanks SVK!

The backend application is web base and will be using AD to authenticate users. Users will have the same AD credentials for SA login so I was thinking form post should work. I have not done this before so I am not sure. I will be testing this in lab but wanted some feedback from community going into this test.