SSO and smart card authentication

Hostname

The host name of the existing SSO Server.

SSO Port

HTTP or HTTPS TCP port used by an existing SSO server. If the port is not https, the Secure (https) Connection option must not be selected.

Secure (https) Connection

Default: not selected.

Select if Secure Socket Layer (SSL) communication is required.

The LDAP bind user distinguished name (DN) to be used for smart card configuration.

The bind user DN is the user on the external LDAP server permitted to search the LDAP directory within the defined search base. Most of the time, the bind DN is permitted to search the entire directory. The role of the bind DN is to query the directory using the LDAP query filter and search base for the DN (distinguished name) for authenticating users. When the DN is returned, the DN and password are used for authentication.

Hostname

Either the host name of the Domain Controller (Active Directory) or the machine that serves LDAP requests (typically the domain controller).

Port

TCP port (by default 389) for the new SSO server.

Base DN

The LDAP base DN for the new SSO server. The base DN is the top level in the LDAP directory tree below which the search for the user should be performed. Looks like this:

CN=Users,DC=your,DC=domain,DC=com

Search Filter

The LDAP search filter for the new SSO server. The installer pre-populates with a

default search filter.

LDAP search filters function within a framework. The framework includes what attributes you are searching on and the value, or range of values, that you are trying to match. Each search filter involves at a least three components:

• The attributes to search for, called the attribute data type.

• The search filter operator that determines what to match, sometimes called the match operator.

• The actual value of the attribute you are searching for.

Each search needs to have a minimum of one of each of the components. You can create compound search filters by connecting two or more search filters modules. They are enclosed in parentheses to clarify filter content, and include one or more of three compound search filter operators (AND, OR, NOT). You can add multiple compound and wildcard filters as long as you have the correct number of matching parentheses.

The actual search filter in the case of Microsoft Active Directory (Domain Controller) should look like:

(&(objectClass=user)(sAMAccountName={0}))

where {0} are substituted by the actual user name that is logging in.

See the LDAP RFC 4515 documentation for more information about LDAP search filters and a mechanism for representing them as strings.

The LDAP bind user DN for the new SSO server.

The bind user DN is the user on the external LDAP server permitted to search the LDAP directory within the defined search base. Most of the time the bind DN is permitted to search the entire directory. The role of the bind DN is to query the directory using the LDAP query filter and search base for the DN for authenticating users. When the DN is returned, the DN and password are used for authentication.

The LDAP password to be used to be used in conjunction with the bind user DN by the new SSO server.

By default, the installer pre-populates this field with same LDAP value it was given earlier for the smart card setup software.