<?xml version="1.0" encoding="utf-8"?>
<Session ID="/baanerp/tt/ams/ttams0100m000" xml:lang="en">
	<Header>
		<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">SSO Parameters (ttams0100m000)</Title>
	</Header>
	<HelpTopic xml:lang="en"><AimSection><Paragraph class="Default"> 
                                 Use this session to configure Single Sign On (SSO). In case SSO is activated for ERP LN, the User Data (ttams1100s000) session shows a number of new fields which are used to map the Infor SSO User to the ERP LN user and the OS user. For security reasons, an OS group (for example bsp) must be setup. This group only contains OS users as members who are allowed to do administrative tasks.</Paragraph>
		</AimSection>
	</HelpTopic>
	<Fields><FieldHelp ID="ttams000.actv"><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">SSO Active</Title>
			</Header>
			<FuncDesc>Default this field is not selected and the rest of the parameters cannot be changed. If this field is selected SSO will become active and the the Infor SSO Service Location and the Generic System User fields will be enabled.</FuncDesc>
		</FieldHelp>
		<FieldHelp ID="ttams000.loca"><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Infor SSO Service Location</Title>
			</Header>
			<FuncDesc>This field is mandatory to fill in if <GUIRef href="" role="manual">SSO Active</GUIRef> is selected. Fill in the URL towards the Infor Security Service location you have set up earlier.</FuncDesc>
			<SimpleSection><List><ListIntro>This parameter is converted into the resource file <Code>$BSE/lib/sso_config</Code> as follows:</ListIntro>
					<ListItem><Code>sso_location:&lt;url&gt;</Code>
					</ListItem>
				</List>
				<Paragraph class="Default">This file must be assigned to and only be writable for the OS group with administrative tasks.</Paragraph>
			</SimpleSection>
		</FieldHelp>
		<FieldHelp><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Windows Domain</Title>
			</Header>
			<FuncDesc>Fill in the windows domain where the user accounts and security information for the resources of your domain reside. For example: infor.</FuncDesc>
		</FieldHelp>
		<FieldHelp ID="ttams000.sysu"><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Generic System User</Title>
			</Header>
			<FuncDesc>This field is mandatory to fill in if <GUIRef href="" role="manual">SSO Active</GUIRef> is selected. The supplied <GUIRef href="" role="manual">Generic System User</GUIRef> will be used when <Code>ipc_boot</Code> is started. However, for individual users this can be overruled by explicitely configuring another System User. Both the OS User and the SSO user are configurable in the <Link href="/baanerp/tt/aad/ttaad2500m000" role="session">User Data (ttaad2500m000)</Link> session. The filled in data here will become the default <GUIRef href="" role="manual">OS User</GUIRef> identity that is used in <Link href="/baanerp/tt/glossary/glossary#SSO" role="glossary">SSO</Link> mode to run the binaries.</FuncDesc>
			<SimpleSection><List><ListIntro>This parameter is converted into the resource file <Code>$BSE/lib/sso_config</Code> as follows:</ListIntro>
					<ListItem><Code>generic_user:&lt;Generic User&gt;</Code>
					</ListItem>
				</List>
			</SimpleSection>
		</FieldHelp>
		<FieldHelp ID="passwd"><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Generic System User password</Title>
			</Header>
			<FuncDesc>For Windows only. On Windows the plain password is needed to switch to a certain user. The password that is entered will be immediately crypted by a key-driven ciphering algorithm. This field is then (for Windows only) converted to runtime into the <Code>sso_config</Code> file as <Code>gu_passwd:&lt;Crypted Password&gt;</Code>.</FuncDesc>
			<Note><SectionTitle>
                                    Note
                                 </SectionTitle>
				<Paragraph class="Default">Be aware that now every user that enters via <GUIRef href="" role="manual">Infor Security Service</GUIRef> will run as the same <GUIRef href="" role="manual">Generic System User</GUIRef> on OS level.</Paragraph>
			</Note>
		</FieldHelp>
		<FieldHelp ID="ttams000.ovsu"><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Overule System User</Title>
			</Header>
			<FuncDesc></FuncDesc>
			<SimpleSection><Paragraph class="Default">This field is default selected. That means that the <GUIRef href="" role="manual">Generic System User</GUIRef> can be overruled per user in the <Link href="/baanerp/tt/ams/ttams1100s000" role="session">User Data (ttams1100s000)</Link> session. Also the field System Login in the <Link href="/baanerp/tt/ams/ttams1100s000" role="session">User Data (ttams1100s000)</Link> session will become editable. If that field is left empty, the value of the SSO parameter <GUIRef href="" role="manual">Generic System User</GUIRef> will be used during the convert to runtime.</Paragraph>
				<Paragraph class="Default">If this field is not selected, every user will run the binaries impersonated as <GUIRef href="" role="manual">Generic System User</GUIRef>. Also, If the SSO parameter <GUIRef href="" role="manual">Overrule System User</GUIRef> is not selected, the field <GUIRef href="" role="manual">System Login</GUIRef> in the <Link href="/baanerp/tt/ams/ttams1100s000" role="session">User Data (ttams1100s000)</Link> is not editable and the value of the SSO parameter <GUIRef href="" role="manual">Generic System User</GUIRef> is shown.</Paragraph>
			</SimpleSection>
		</FieldHelp>
	</Fields>
	<FormCommands><CommandHelp><Header>
				<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Dump</Title>
			</Header>
			<FuncDesc>Click <GUIRef href="" role="manual">Dump</GUIRef> to convert the <GUIRef href="" role="manual">Infor SSO Service Location</GUIRef> and the <GUIRef href="" role="manual">Generic System User</GUIRef> data to file <GUIRef href="" role="manual">$BSE/lib/sso_config</GUIRef>.</FuncDesc>
		</CommandHelp>
	</FormCommands>
</Session>
