| # SSO Parameters (ttams0100m000) Use this session to configure Single Sign On (SSO). In case SSO is activated for LN, the User Data (ttams1100s000) session shows a number of new fields which are used to map the Infor SSO User to the LN user and the OS user. For security reasons, an OS group (for example bsp) must be setup. This group only contains OS users as members who are allowed to do administrative tasks. SSO Active Default this field is not selected and the rest of the parameters cannot be changed. If this field is selected SSO will become active and the Infor SSO Service Location and the Generic System User fields will be enabled. Infor SSO Service Location This field is mandatory to fill in if SSO Active is selected. Fill in the URL towards the SSO Service location you have set up earlier. This parameter is converted into the resource file `$BSE/lib/sso_config` as follows: `sso_location:<url>` This file must be assigned to and only be writable for the OS group with administrative tasks. Windows Domain Fill in the windows domain where the user accounts and security information for the resources of your domain reside. This is usually <company name> for example: infor, or in case of a local account the machine name. Generic System User This field is mandatory to fill in if SSO Active is selected. The supplied Generic System User will be used when `ipc_boot` is started. This user will be used to login on the OS when ERP LN is started through SSO. However, for individual users this can be overruled by explicitly configuring another System User. Both the OS User and the SSO user are configurable in the User Data (ttaad2500m000) session. The filled in data here will become the default OS User identity that is used in SSO mode to run the binaries. This parameter is converted into the resource file `$BSE/lib/sso_config` as follows: `generic_user:<Generic User>` Note You must enter a user that resides in the domain specified in the Windows Domain field. Generic System User password The password of the user specified in the Generic System User field. For Windows only. On Windows the plain password is needed to switch to a certain user. The password that is entered will be immediately crypted by a key-driven ciphering algorithm. This field is then (for Windows only) converted to runtime into the `sso_config` file as `gu_passwd:<Crypted Password>`. Note Be aware that now every user that enters via SSO Service will run as the same Generic System User on OS level. Overrule System User Allowed This check box is default selected. That means that the Generic System User can be overruled per user in the User Data (ttams1100s000) session. Also the System Login field in the User Data (ttams1100s000) session will become editable. If that field is left empty, the value of the SSO parameter Generic System User will be used during the convert to runtime. If this check box is cleared, every user will run the binaries impersonated as Generic System User. Also, if the SSO parameter Overrule System User is not selected, the System Login field in the User Data (ttams1100s000) session is not editable and the value of the SSO parameter Generic System User is shown. Note In a Windows environment, you cannot select this check box. You can only overrule the generic system user in non-Windows environments. Dump Click Dump to convert the Infor SSO Service Location and the Generic System User data to file $BSE/lib/sso_config. |