| Configuring Federation Services for ERP LN with Web UI |  |
| Single Sign On with Active Directory Federation Services (AD FS) Introduction This diagram shows the components which play a role in Single Sign On for Web UI using Microsoft’s Active Directory Federation Services (AD FS). To configure Web UI for AD FS, three keystores are required. See the previous diagram. Two keystores are used to establish a trust relation between the ERP LN server and the Web UI server. The third keystore enables https on the Web UI server. For details on how to create these keystores, see the following section. Prerequisites AD FS 2.0 must be installed and the basic configuration must be performed. For details, see Installing and configuring AD FS. ERP LN 6.1 FP7 and Web UI 8.7 must be installed. Configuring Federation Services for ERP LN with Web UI This section describes the procedure to configure Web UI and AD FS so that ERP LN users are authenticated through federation services. There are 2 scenarios: ERP LN/ Web UI is used in an environment with Infor Federation Services (IFS); for example in a setup with Companion. IFS is used to configure AD FS. ERP LN/ Web UI is used in an environment without IFS. Scripts provided with ERP LN/ Web UI will be used to configure AD FS. See the following procedure for details. Important! IFS will be released in February 2011. For details on IFS, see: Infor Federation Services Configuration guide (U9663 US) Infor Federation Services AD FS and IFS Installation Guide (U9661 US) Procedure To configure Federation Services for ERP LN with Web UI: Step 1. Download policy files. Download 'Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files' for Java 6. Complete these steps: Open this URL: `http://www.oracle.com/technetwork/java/javase/downloads/index.html` Install the files in the [JRE_HOME]/lib/security directory on the Web UI Web server. Note: If there are multiple JREs on the Web UI Web server, ensure you install the files in the JRE that belongs to Web UI. If you do not install these files, this error message can be displayed because the keystore file generation is using long key sizes for the keys: Step 2. Restart Tomcat. Step 3. Generate/Update Keystores. Complete these steps: Start the Web UI Administration Console. Select Infor ERP > Infor ERP Environments to open the Manage INFOR ERP ENVIRONMENTS page. Select an environment that uses the Federation Services Protocol and click Generate/Update Keystores to display the Federation Services Settings dialog. Specify the required information. For details, see the online help of the Federation Services Settings dialog. Click OK in the Federation Services Settings dialog. This question is displayed: `Are you sure? Existing keystores will be modified.` Click Yes in the question window. A dialog showing the progress is displayed. When the process is finished, click Close in the Progress dialog. Step 4. Restart Tomcat. Step 5. Finish the configuration. Complete one of these steps: If you selected the Call IFS Webservice check box in the Federation Services Settings dialog, you must activate the application in Infor Federation Services (IFS). To activate the application, open this URL in your browser: `https://[IFS server]:[port]/IFS/`. If you cleared the Call IFS Webservice check box in the Federation Services Settings dialog, you must complete these steps: Create a relying party and configure AD FS. For details, see solution 253112. Ensure the ID of the new relying party is identical to the ID you specified in the Relying Party identifier field in the Federation Services Settings dialog. Ensure the idp.xml file is present in `[WebUI-root]/config/fedlet/conf/idp.xml`. You can retrieve the idp.xml file from the AD FS server through this URL: `https://[AD FS server]/FederationMetadata/2007-06/FederationMetadata.xml`. Important! If a step fails, view the generated error message and try to solve the error. For example: If you specified an incorrect Tomcat Base Directory in the Federation Services Settings dialog, this progress dialog is displayed: |