<?xml version="1.0" encoding="utf-8"?>
<ManualTopic ID="/baanerp/tt/onlinemanual/single_sign_on_login" xml:lang="en">
	<Header>
		<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Single Sign On Login Process</Title>
		<Keyword ContextSensitive="No"><Level1>SSO</Level1>
		</Keyword>
	</Header>
	<AimSection><Paragraph class="Default">In case of Single Sign On ( <Link href="/baanerp/tt/glossary/glossary#SSO" role="glossary">SSO</Link> ) the user will no longer directly logon to the backend. First the user must connect to the Infor SSO with a username and password. Therefore they only need to log on once without being prompted for their username and password every time they want to start an Infor application.</Paragraph>
	</AimSection>
	<GeneralSection><SectionTitle>Logon Window</SectionTitle>
		<Paragraph class="Default">For example: an end user wants to logon using the WebTop. This user will be redirected to the CAS server to logon to SSO. A logon window appears:</Paragraph>
		<Paragraph class="Default"><HTML:IMG height="313" width="584" SRC="../images/nt_screen_single_sign_on_login.gif" path="/enterpriseserver/tools/tt/onlinemanual" btb-count="1" btb-count2="1" btb-image-name="nt_screen_single_sign_on_login.gif" btb-source-path="C:\SVN\docnl\Technology\EnterpriseServer~8.5\EnterpriseServer" btb-image-path="/enterpriseserver/tools/tt/images/nt_screen_single_sign_on_login.gif" ID="IDAC2WBC" alt="[...]" xmlns:HTML="http://www.w3.org/TR/REC-html40"/></Paragraph>
		<Paragraph class="Default">The logon window of the SSO service is used to enter username and password to check if the user is authenticated.</Paragraph>
	</GeneralSection>
	<GeneralSection><GeneralSection><SectionTitle>Tickets</SectionTitle>
			<Paragraph class="Default">After a valid authentication, a ticket granting cookie will be generated and stored in the Browser. The login screen will not reappear anymore. Subsequently, only tickets are passed between applications, which must be validated with the SSO service. Note that if WebTop is started from a homepage the user has already logged on and a ticket is already available in the Browser. No login screen will appear.</Paragraph>
		</GeneralSection>
		<GeneralSection><SectionTitle>Blogin daemon and SSO ID</SectionTitle>
			<Paragraph class="Default">To let the user access ERP LN the last validation will be done by the BLogin daemon. WebTop receives a ticket from SSO server. This ticket is send to BLogin with a request to start a bshell for the user that is described in the ticket. Blogin verifies the ticket with SSO and in case the ticket is valid, BLogin will receive an Infor SSO ID.</Paragraph>
			<List><ListIntro>This SSO ID will be mapped to the following files on disk:</ListIntro>
				<ListItem>$BSE/lib/user/sso/s&lt;sso_user&gt;</ListItem>
				<ListItem>$BSE /permissions/sso_permissions.xml</ListItem>
			</List>
			<Paragraph class="Default">BLogin will use the SSO user to extract the Application User and the System User (listed as ‘baan and unixuser’ in the s&lt;sso_user&gt; file) from the supplied BSE environment.</Paragraph>
			<Paragraph class="Default">BLogin will check in $BSE/lib/sso.permissions whether the SSO user is allowed to switch to the found System User.</Paragraph>
			<Paragraph class="Default">BLogin impersonates the found System User, starts a bshell and connects to WebTop. The user is authorized to start the application.</Paragraph>
		</GeneralSection>
	</GeneralSection>
	<GeneralSection><SectionTitle>sso_permissions.xml</SectionTitle>
		<Paragraph class="Default">To secure the impersonation step of the process, the system administrator must manually create the sso_permissions.xml file.</Paragraph>
		<Paragraph class="Default">The permissions file is stored in a separate directory, because the permissions on the $BSE/lib directory are not secure enough. Various convert-to-runtime sessions must be able to write in this directory.</Paragraph>
		<Paragraph class="Default">In the home BSE of the BaanLogin Daemon, create the separate configuration file $BSE/security/sso_permissions.xml</Paragraph>
		<List><ListIntro>The system administrator must correctly secure the following directories and file:</ListIntro>
			<ListItem>$BSE</ListItem>
			<ListItem>$BSE/security</ListItem>
			<ListItem>$BSE/security/sso_permissions.xml</ListItem>
		</List>
		<List><ListIntro>The following elements are verified:</ListIntro>
			<ListItem>SSO Location: must match with the location format in $BSE/lib/sso_config.</ListItem>
			<ListItem>Impersonation</ListItem>
		</List>
		<ExampleSection><SectionTitle>
                                 Example
                              </SectionTitle>
			<Paragraph class="Default">Examples of an sso_permissions.xml files.</Paragraph>
			<Paragraph class="Default">
                                 Example 1: all users will be impersonated as bsp (generic user).</Paragraph>
			<CodeBlock space-and-orientation="indented-estimated">&lt;?xml version="1.0" ?&gt;
&lt;SingleSignOn&gt;
    &lt;impersonations
              sso_location=" https://InforSSOServer:8443/cas/"&gt;
        &lt;impersonation os_user="&lt;domain&gt;bsp"&gt;
                &lt;sso_user name="*"/&gt;
        &lt;/impersonation&gt;
    &lt;/impersonations&gt;
&lt;/SingleSignOn&gt;
</CodeBlock>
			<Paragraph class="Default">
                                 Example 2: An user will be impersonated as their own u&lt;user&gt; file.</Paragraph>
			<CodeBlock space-and-orientation="indented-estimated">&lt;?xml version="1.0" ?&gt;
 * &lt;SingleSignOn&gt;
 *     &lt;impersonations
 *               sso_location=" https://InforSSOServer:8443/cas/"&gt;
       &lt;impersonation os_user="*"&gt;
 *             &lt;sso_user name="+"/&gt;
 *         &lt;/impersonation&gt; 
 *     &lt;/impersonations&gt;
 * &lt;/SingleSignOn&gt;
</CodeBlock>
			<Paragraph class="Default">
                                 Example 3: User John Doe or Jane Doe will be impersonated as OS user jdoe.</Paragraph>
			<CodeBlock space-and-orientation="indented-estimated">&lt;?xml version="1.0" ?&gt;
&lt;SingleSignOn&gt;
    &lt;impersonations
              sso_location=" https://InforSSOServer:8443/cas/"&gt;
      &lt;impersonation os_user="&lt;domain&gt;\jdoe"&gt;
            &lt;sso_user name="John Doe"/&gt;
            &lt;sso_user name="Jane Doe"/&gt;
        &lt;/impersonation&gt;
    &lt;/impersonations&gt;
&lt;/SingleSignOn&gt;
</CodeBlock>
		</ExampleSection>
	</GeneralSection>
	<RelatedTopics><SectionTitle>
                              Related topics
                           </SectionTitle>
		<RelTopic></RelTopic>
	</RelatedTopics>
</ManualTopic>
