| # Login Process ERP LN supports these mechanisms to communicate with the back-end: Rexec protocol ES Logic Service (Blogin daemon) SSPI (Windows only) Single-sign on (SSO) Rexec protocol By using the rexec protocol the standard remote exec protocol, by default listening on port 512 is used. This protocol is a non-secure protocol. ES Logic Service (Blogin daemon) Blogin is a secure alternative for the rexec protocol. It requires starting as a separate daemon for UNIX. The Blogin allows tracking of login attempts. For Windows this is registered in the EventViewer, for UNIX in log.blogin. blogin6.2 –p 7150 –ssl security/ssl.properties The option –p <port number> specifies the port number used by the Blogin daemon. When this option is omitted, the default port number is 7150. The option –ssl <ssl properties file> specifies the ssl properties file to be used, relative to the BSE directory of the Baan Login daemon. When this option is omitted, the default ssl properties file is: security/ssl.properties Prefix the file name with a @-sign so it will not be interpreted relative to the BSE directory of the Baan Login daemon. For example use –ssl @local_file or –ssl @/etc/absolute_path. To start this daemon for problem tracing use: >blogin6.2 –p 7150 –ssl security/ssl.properties –d > ${BSE}/log/blogin.log 2>&1 The trace output will be sent to the file ${BSE}/log/blogin.log. SSPI For Windows: Solution 22893740 describes how auditing can be turned on to register logon of users. SSO through Federation Services A Single Sign On (SSO) solution removes authentication from the applicative code, and offers a globally secure software environment for users to provide their credentials once to access multiple applications. Single Sign On by using Federation Services can be activated by 2 Enterprise Server sessions: SSO Parameters (ttams0100m000) session User Data (ttams1100s000) session After running the session Convert changes to runtime DD (ttams2200m000) the following new files will appear in $BSE/lib/user : $BSE/lib/user/sso/s<SSO_USER> $BSE/lib/user/sso/<baanuser> For more specific information refer to the online help of these Enterprise Server sessions or the Infor10 ERP Enterprise Server (LN) Administrator's Guide (U8854 US). Other files on disk for SSO are:: $BSE/lib/sso_config UNIX $BSE/security/sso_permissions.xml $BSE/security/ssl.properties Windows $GLOBAL/security/sso_permissions.xml $GLOBAL/security/ssl.properties sso_config file This file is configured through the SSO parameters session (ttams0100m000) This file contains the following SSO configuration parameters: sso_location:<URL to CAS, which is the SSO server Infor uses> Only applicable for SSO through Infor Security. Note: Infor Security will be deprecated in the future by Infor. generic_user:<Windows only – the name of the generic OS user name, used to start the Bshell> gu_passwd:<Windows only – the crypted password for the generic OS user> sso_permissions.xml file This file is maintained manually. A sample sso_permissions file will be placed in one of the following directories: $BSE/security (on UNIX) $GLOBAL\security (on Windows) This file describes which SSO user can impersonate a specific OS user. Protection is needed in case end-users try to change the configuration in the User Data in such a way that they can start a Bshell as for example OS user root. ssl.properties file This file is maintained manually The property file ssl.properties contains the pathname and password of the keystore file used for the SSL communication with WebUI. An example of the ssl.properties file: keystore: c:\Infor\ERPLN\commonx64\security\nlbaltoolsdev.p12 password: changeit A default keystore filename is: c:\Infor\ERPLN\commonx64\security\keystore.p12. This default is used when the keystore line is omitted from the ssl.properties file.An alternative location for the ssl.properties file can be given via the following parameter when starting blogind: -ssl <filename> PAM Pluggable authentication modules (PAMs) allow a UNIX computer to support multiple authentication technologies. Password Synchronization uses PAMs to provide UNIX-to-Windows password synchronization. The Password Synchronization PAM module (pam_sso) must be installed on each UNIX host where users can change their passwords. The PAM library is a generalized API for authentication-related services which allows a system administrator to add new authentication methods simply by installing new PAM modules, and to modify authentication policies by editing configuration files. If PAM is configured and enabled on the UNIX system, these protocols will use the PAM features that are available on the system: blogind rexec Password Aging The authentication of users logging in through ERP LN is handled using the normal system interfaces and PAM is used to handle the authentication. In case of the Password Aging the PAM libraries are used. For more specific information about PAM refer to the Unix Manual Pages ( `man 5 pam.conf`). From ERP LN perspective the use of PAM is transparent. No installation or configuration is needed on the ERP LN side. Environment variables for PAM These environment variables can be used to trace PAM issues: `PAM_SET_DEBUG`: when set to "1", trace messages are sent to stderr. `PAM_TEST_LOG`: if this environment variable is set, trace messages are sent to the file test.log `` in the directory/tmp These environment variables are available for badmin6.2: `BADMIN_USE_PLAIN_PASSWORD`: if this variable is set, a plain text password can be specified on the command line. This is useful for detecting badmin6.2 problems using the command line. This works for the options –chkpasswd and –chgpwd `CHECK_PASSWORD_DEBUG=2` Test whether the password is changeable `CHECK_PASSWORD_DEBUG=3` Test the password warning feature `CHECK_PASSWORD_DEBUG=4` Test the password expire feature. The warning in time is 7 days Using PAM has a limitation. The PAM library interface can not determine the exact number of days when a password will expire. It can only indicate that a password is about to expire. You can place the resource named pwd_default_warn in the directory: $BSE/lib/defaults/all Set the warning indication to a certain value to let the resource supply a number of days. The default is 3 days. |