# SSO authentication

This topic describes how to set up single sign-on (SSO) authentication for connecting to LoadRunner Enterprise. This enables users to log in to LoadRunner Enterprise and LoadRunner Enterprise Administration using SSO.

In this topic:

## Overview

You can configure LoadRunner Enterprise with SSO authentication. This way, users can use single sign-on for logging into LoadRunner Enterprise as they do with other SSO applications.

To facilitate single sign-on, the LoadRunner Enterprise service provider (SP) sends an authentication request to the Identity Provider (IdP), which is an online service that authenticates users using security tokens.

Service providers and protocols

LoadRunner Enterprise's SSO integration uses the SAML2 protocol for authentication with IdPs. LoadRunner Enterprise can use any IdP that supports SAML2.

The following IdPs have been tested with LoadRunner Enterprise: ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server.

Handling existing internal users

All users must be in the LoadRunner Enterprise database before they can be authenticated using any one of the authentication types. For example, all SSO users must be in LoadRunner Enterprise before you switch to SSO authentication. For details on creating users, see Create a new user.

Back to top

## Prerequisites for SSO authentication

This section describes the prerequisites for setting up SSO authentication in LoadRunner Enterprise.

Note: For details on how to configure the IdP you are using, see the documentation provided by your IdP.

1. Issue a certificate and export private information.

   Create a certificate for the LoadRunner Enterprise service provider using any certificate tool, such as OpenSSL, and extract the private information from it (it should be a .pfx file).

2. Upload certificate and share metadata with the IdP.

   For SP3:

   1. Upload the local certificate to LoadRunner Enterprise Administration.

      1. In LoadRunner Enterprise Administration, select Configuration > Site Configuration, and click the Authentication Type tab.

      2. Expand the SSO section, and click the Upload button adjacent to the Local Certificate File field.

      3. Select the name of the local certificate file to use to integrate with the IdP from LoadRunner Enterprise, and then click Save.

   2. Share LoadRunner Enterprise’s metadata and the certificate with the IdP.

      1. Click Metadata to download the local SAML metadata file.

      2. Select the provider in the Identity Providers list, and click Download to download the metadata file and the LoadRunner Enterprise certificate.

         Note: Select Okta if your IdP is not displayed in the list.

      3. Send the LoadRunner Enterprise metadata and certificate file to your ldP.

   For SP2:

   1. Copy the .pfx file to the <LoadRunner Enterprise Server installation>\PCWEB\Certificates and <LoadRunner Enterprise Server installation>\PCWEB_ADMIN\Certificates folder.

   2. Establish trust between the LoadRunner Enterprise SP and the IdP by sharing LoadRunner Enterprise’s metadata with the IdP.

      - To obtain LoadRunner Enterprise’s metadata for the IdP, navigate to `<protocol>://<host>:<port>/LoadTest/SAML/ExportMetadata.aspx`, and click Download Metadata to share metadata between the providers.

      - To obtain LoadRunner Enterprise Administration’s metadata for the IdP, navigate to `<protocol>://<host>:<port>/Admin/SAML/ExportMetadata.aspx`, and click Download Metadata to share metadata between the providers.

      The metadata is available only after the LoadRunner Enterprise server starts.

      Note:

      - While enabling the service provider, the IdP’s metadata was already shared with LoadRunner Enterprise. The metadata can be supplied with a URL or by a file.

      - Generally, depending on your individual IdP, you either provide this URL in the IdP’s configuration screens, or save the XML and import it into the IdP. This configures the LoadRunner Enterprise SP as a client for your IdP.

3. Configure the IdP.

   In the IdP, make sure you create two applications—one for LoadRunner Enterprise Administration (Admin) and one for LoadRunner Enterprise (Loadtest).

4. Add the initial user (recommended).

   The first user created in LoadRunner Enterprise has site administrator permissions and is allowed to perform any action in the LoadRunner Enterprise system.

   Tip: We recommend adding this user to the SSO. Later, you can add additional IdP users and make them administrator users.

Back to top

## Configure SSO authentication

Configure LoadRunner Enterprise and its service provider for SSO authentication.

1. In LoadRunner Enterprise Administration, select Configuration > Site Configuration, and click the Authentication Type tab.

2. Expand the SSO section and enter the following:

   UI Element | Description
   --- | ---
   SP Identity | Enter the LoadRunner Enterprise service provider identifier. Available in versions: SP2 (in SP3 this was moved to the Admin and LoadTest section)
   Admin | SP Identity. Enter the LoadRunner Enterprise service provider identifier. Issuer Identity Provider. Enter a unique identifier of the IdP. Includes ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server. Single Sign on Link. Enter the SSO link you created in the IdP for accessing the LoadRunner Enterprise Administration application. Single Logout Link. Enter the link you created in the IdP for logging out the LoadRunner Enterprise Administration application. When a user logs out from LoadRunner Enterprise Administration, they are automatically logged out from all connected applications that were authenticated using the IdP. After a user logs out, the SSO login screen is displayed. Partner Certificate File. Click Upload and select the partner certificate file you downloaded from the IdP. The supported certificate types are .cert, .cer, .pfx.
   LoadTest | SP Identity. Enter the LoadRunner Enterprise service provider identifier. Issuer Identity Provider. Enter a unique identifier of the IdP. Includes ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server. Single Sign on Link. Enter the SSO link you created in the IdP for accessing the LoadRunner Enterprise application. Single Logout Link. Enter the link you created in the IdP for logging out the LoadRunner Enterprise application. When a user logs out from LoadRunner Enterprise, they are automatically logged out from all connected applications that were authenticated using the IdP. After a user logs out, the SSO login screen is displayed. Partner Certificate File. Click Upload and select the partner certificate file you downloaded from the IdP. The supported certificate types are .cert, .cer, .pfx.
   Local Certificate File | In SP3: Click Upload and select the name of the local certificate file to use to integrate with the IdP from LoadRunner Enterprise. In SP2: Name of the local certificate file to use to integrate with the IdP from LoadRunner Enterprise. You can get the file name by copying it from the Certificates folder in the LoadRunner Enterprise server installation folder. Example: `Certificates\sp.pfx`
   Partner Certificate File | Click Upload and select the partner certificate file you downloaded from the IdP. The supported certificate types are .cert, .cer, .pfx. Available in versions: SP2 (in SP3 this was moved to the Admin and LoadTest section)
   Local Certificate Password | Enter the password that was used for generating the certificate. Available in versions: SP3 and later
   User Login column | Select whether to login using your username or email for SSO authentication. Available in versions: SP3 and later
   Description | (Optional) Add a description of the SSO authentication.

3. Click Save to save your settings.

   To restore the default SSO settings, click Restore.

4. Click Select this authentication type to set external SSO authentication as the authentication type for all users.

   The selected authentication type is indicated by .

Back to top

## Test SSO authentication

This section describes how to test SSO authentication for the LoadRunner Enterprise user interface.

1. To log in to LoadRunner Enterprise using SSO, navigate to the LoadRunner Enterprise or LoadRunner Enterprise Administration URL. You should be redirected to your IdP’s login screen.

2. Log in with the LoadRunner Enterprise admin credentials.

   - For LoadRunner Enterprise: You are redirected to the LoadRunner Enterprise Login window from which you need to select a domain and project (the username and password are already filled in).
   - For LoadRunner Enterprise Administration: You are redirected to LoadRunner Enterprise Administration and you can now use the application.

Back to top

## Notes and limitations

The following are notes and limitations when using SSO authentication:

- SSO authentication is not supported using REST APIs.

- When enabling single-sign on with Azure Active Directory as the IdP, the internal URLs for the LoadRunner Enterprise and LoadRunner Enterprise Administration applications must use `https` and not `http`.

Back to top

See also:

- Select authentication type

https://admhelp.microfocus.com LoadRunner Enterprise 8942
Tips to improve your search results... LoadRunner Enterprise Help Center LoadRunner Enterprise Help LR Enterprise Help 2020_SP2-SP3 All View Local Help Center View Online Help Center back Go back in browser history forward Go forward in browser history Remove search highlights next topic Go to next topic previous topic Go to previous topic Print the current topic Version: