| To set up Single Sign On |  |
| The principle of a Single Sign On (SSO) solution is to remove authentication from the applicative code. SSO offers a globally secured software environment where users have to provide their credentials only once to gain access to multiple applications. Depending on configuration settings users can be signed on automatically based on their Windows credentials. After signing on once, users can navigate from one application to another without having to sign on again. For example, after signing on, a user can drill back from Key Performance Indicators (KPIs) in a PM Dashboard to details in ERP LN. During the drill back actions, the relevant ERP LN sessions start directly; the user does not have to sign on to ERP LN. ERP LN is enabled for two types of Single Sign On: Single Sign On with Active Directory Federation Services (AD FS) See the Infor ERP LN Web User Interface - Installation and Configuration Guide (U8715 US). Single Sign On based on Central Authentication Service (CAS) See the SSO sections in this chapter and the appendices. Important! Infor recommends to use Single Sign On with AD FS. Single Sign On based on CAS is only supported for existing customers. Infor SSO User Identity in ERP LN Generally there are two types of users: Operating System User (OS User) Application User The Infor SSO user will be a third kind of user which is needed for the SSO Service. The major role of the SSO User besides authentication, is to make the mapping towards the correct OS User and Application User. For security reasons, an Operating System (OS) group, for example bsp must be setup. This group can only contain OS users that are allowed to do administrative tasks. For an ERP LN environment on Windows, a Generic System User must be created and be available on OS level, for example: infor_ln. Default, this Generic System User will be used when `ipc_boot` is started. It is possible to use SSO for some users and OS authentication for other users. Example For example in the following situations: The administrator has enabled SSO for all accounts, and wants for his own account (as fallback) keep an option to logon with his OS account in case SSO does not work. Some client applications can not work (yet) with Infor SSO and other applications such as PM Dashboards do not operate without Infor SSO. Configuration of SSO on ERP LN The session SSO Parameters (ttams0100m000) is defined and the User Data (ttams1100s000) session is extended with extra fields. Also the Convert to Runtime DD session required changes. Note Create the `sso_permissions.xml` file manually. In this way you prevent that malicious end-users will try to change the configuration in the User Data to start a Bshell as for example OS user root. Place the `sso_permissions.xml` file in the BSE of the logic service. Infor SSO integration will not work if `sso_permissions.xml` is not created. For specific information see section "Single Sign On Login Process". Session SSO Parameters (ttams0100m000) To specify the SSO parameters take these steps: Start the session SSO Parameters (ttams0100m000) Specify the URL towards the SSO Service. For ADFS integration this field is not relevant. Supply the Generic System User. The Generic System User needs to be registered in the sso_permissions.xml file. This is described later. Click Dump to place the information in the `$BSE/lib/sso_config` file. Refer to the online help of this session for more specific field information. Session User Data (ttams1100s000) In case SSO is activated through SSO Parameters (ttams0100m000) the User Data (ttams1100s000) session will be extended with the following two fields: Infor SSO User. Use Generic System User. The Infor SSO User For AD FS must be known in Active Directory (UPN). See the Infor ERP LN Web User Interface - Installation and Configuration Guide (U8715 US) for more specific information. For CAS must be known at the SSO Service. Select the field Use Generic System User to use the Generic System User defined in the SSO Parameters (ttams0100m000) session. If this field is cleared the System Login will be used. In case the System Login is used, make sure this user is registered in the sso_permissions.xml file. This file is described later. Note In case of a Windows install. The User Data (tams1100m000) session will contain another extra field, namely the Generic System User Password field. On Windows the plain password to switch to a certain user is mandatory. This password will be immediately encrypted and during the conversion to runtime placed into the `%BSE%\lib\sso_config` file as `gu_passwd`. Conversion to runtime After you have entered the needed SSO information you must activate SSO for the ERP LN users as follows: Save and Close the User Data (ttams1100s000) session. You will return to the Main User Data (ttaad2500m000) session. On the Specific menu in the User Data (ttaad2500m000) session, click Convert Changes To Runtime DD. The Convert Changes to Runtime DD (ttams2200m000) session appears. Enter the required data in the Convert Changes to Runtime DD (ttams2200m000) session. Refer to the session help for details. Click Convert to Runtime to convert the user data to an encoded s[SSO User] file in the `$BSE/lib/user/sso/` directory. This file contains information about: sso_user:[SSO User] baanuser:[baanuser] unixuser:[OSuser] |