Share this page

# SSO authentication

This topic describes how to set up single sign-on (SSO) authentication. This enables users to sign in to the Performance testing application and Administration using single sign-on.

Note: SSO is supported with a secure HTTP connection only (SSL configured environment).

In this topic:

## Overview

You can configure SSO authentication. This way, users can use single sign-on for logging on as they do with other SSO applications.

To facilitate single sign-on, the OpenText Enterprise Performance Engineering service provider (SP) sends an authentication request to the Identity Provider (IdP), which is an online service that authenticates users using security tokens.

Service providers and protocols

OpenText Enterprise Performance Engineering's SSO integration uses the SAML2 protocol for authentication with IdPs. Any IdP that supports SAML2 can be used.

The following IdPs have been tested: ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server.

Handling existing internal users

All users must be in the database before they can be authenticated using any one of the authentication types. For example, all SSO users must be in OpenText Enterprise Performance Engineering before you switch to SSO authentication. For details on creating users, see Create or edit a user.

Back to top

## Prerequisites

This section describes the prerequisites for setting up SSO authentication.

Note: For details on how to configure the IdP you are using, see the documentation provided by your IdP.

1. Configure OpenText Enterprise Performance Engineering to work with HTTPS.

   SSO is supported with a secure HTTP connection only (SSL configured environment). For details, see Configure servers and hosts to work with TLS/SSL.

2. Issue a certificate and export private information.

   Create a certificate for the OpenText Enterprise Performance Engineering SP using any certificate tool, such as OpenSSL, and extract the private information from it (the certificate should be a .pfx file).

3. Upload the local certificate to Administration.

   1. In Administration, select Configuration > Site Configuration, and click the Authentication Type tab.

   2. Expand the SSO section, and click the Upload button.

   3. Select the name of the local certificate file to use to integrate with the IdP from OpenText Enterprise Performance Engineering, and then click Open.

   4. In the Local Certificate Password field, enter the password that was used for generating the certificate.

   5. Click Save.

4. Share OpenText Enterprise Performance Engineering’s metadata and the certificate with the IdP.

   1. Click Download Metadata to download the local SAML metadata file and the OpenText Enterprise Performance Engineering certificate.

   2. Send the OpenText Enterprise Performance Engineering metadata and certificate file to your ldP.

5. Configure the IdP.

   In the IdP, make sure that you create two applications, one for Administration (Admin) and one for Performance testing application (LoadTest).

6. Add the initial user to SSO (recommended).

   The first user created has site administrator permissions, and can perform any action in the Performance testing application.

   Tip: We recommend adding this user to the SSO. Later, you can add additional IdP users and make them administrator users.

Back to top

## Configure SSO authentication

Configure OpenText Enterprise Performance Engineering and its service provider for SSO authentication.

Note: We recommend using Two-Factor Authentication and/or Captcha when using SSO authentication.

1. In Administration, select Configuration > Site Configuration, and click the Authentication Type tab.

2. Expand the SSO section and enter the following.

   UI Elements | Description
   --- | ---
   Admin | SP Identity. Enter the OpenText Enterprise Performance Engineering service provider identifier. Issuer Identity Provider. Enter a unique identifier of the IdP. Includes ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server. Single Sign on Link. Enter the SSO link you created in the IdP for accessing the Administration application. Single Logout Link. Enter the link you created in the IdP for logging out the Administration application. When a user logs out from Administration, they are automatically logged out from all connected applications that were authenticated using the IdP. After a user logs out, the SSO login screen is displayed. Partner Certificate File. Click Upload and select the partner certificate file you downloaded from the IdP. The supported certificate types are .cert, .cer, .pfx.
   LoadTest | SP Identity. Enter the OpenText Enterprise Performance Engineering service provider identifier. Issuer Identity Provider. Enter a unique identifier of the IdP. Includes ADFS, Azure AD, Bitium, Centrify, Google, MVC, OWIN, Okta, OneLogin, PingOne, Salesforce, Shibboleth, and WSO2 Identity Server. Single Sign on Link. Enter the SSO link you created in the IdP for accessing the Performance testing application. Single Logout Link. Enter the link you created in the IdP for logging out the Performance testing application. When a user logs out of the Performance testing application, they are automatically logged out from all connected applications that were authenticated using the IdP. After a user logs out, the SSO login screen is displayed. Partner Certificate File. Click Upload and select the partner certificate file you downloaded from the IdP. The supported certificate types are .cert, .cer, .pfx.
   User login column | Select whether to login using your user name or email for SSO authentication.
   Description | (Optional) Add a description of the SSO authentication.
   Token timeout (minutes) | Set the expiration timeout for a SSO authentication token. For details, see Integrations. Default value: 1 minute

3. Click Save to save your settings.

   To revert back to the last saved SSO settings, click the Restore button .

4. Click Select this authentication type to set external SSO authentication as the authentication type for all users.

Back to top

## Test SSO authentication

You can test SSO authentication to the Performance testing application and Administration from the user interface.

To test SSO authentication:

1. To sign in using SSO, enter the Performance testing application or Administration URL. You should be redirected to your IdP’s login screen.

2. Sign in with the OpenText Enterprise Performance Engineering admin credentials.

   - For the Performance testing application: You are redirected to the Performance testing application Login window from which you need to select a domain and project (the user name and password are already filled in).
   - For Administration: You are redirected to Administration and you can now use the application.

Back to top

## Integrations

When SSO authentication is enabled, other OpenText products (VuGen, Analysis, and Entity Unlocker) can integrate securely using a single set of credentials.

You can set the expiration timeout for SSO authentication in the Token Timeout field. For details, see Configure SSO authentication.

You can set a maximum timeout value for SSO authentication globally from the configuration file. Go to <Server_installdir>\LRE_BACKEND\ and open the appsettings.defaults.json file. In the SiteSSOOptions section, enter a maximum timeout value in minutes.

Note: Configuring a timeout value in the Token Timeout field higher than the maximum timeout value results in an error.

Back to top

## Notes and limitations

The following are notes and limitations when using SSO authentication:

- When enabling single-sign on with Azure Active Directory as the IdP, the internal URLs for the Performance testing application and Administration must use `https` and not `http`.

- If you have SSO configured and you upgrade from 2023 or earlier, you need to manually copy the certificates from PCWEB_ADMIN\Certificates to LRE_ADMIN\binary\Certificates.

- HTTP-Redirect (GET) binding for SSO authentication requests is not supported; only HTTP-POST binding is supported.

Back to top

See also:

- Select authentication type

https://admhelp.microfocus.com Enterprise Performance Engineering,LoadRunner Enterprise 8942
Tips to improve your search results...OpenText™ Enterprise Performance Engineering Help Center OpenText™ Enterprise Performance Engineering Help 26.1 All View Local Help Center View Online Help Center Version: