Share this page

# Web Service Single Sign-On

As with many other PPM Web components, PPM Web services is able to integrate with most industry-standard single sign-on (SSO) systems such as CA SiteMinder, Oracle Identity Management, RSA Sign-On Manager, and IBM Tivoli Access Manager through pluggable authentication frameworks. PPM provides a log-in module for SiteMinder. For other SSO systems, additional customization may be required.

You can integrate with SiteMinder using the PPM SiteMinder Log-in Module. When this authentication mode is used, PPM authenticates users to SiteMinder, and does not store user passwords in the PPM database.

## PPM Server Configuration

From the PPM server side, you can add the following parameters into the server.conf file:

- To allow SiteMinder Login Module to be invoked for Web service user authentication, set the following parameter:

  com.kintana.core.server.ENABLE_WEBSERVICE_SSO=true

- To choose SiteMinder to be the authentication mode, set the following parameter:

  com.kintana.core.server.authethentication_mode=SiteMinder
  Note: If SiteMinder is chosen as the only authentication mode, any individual user's authentication mode that was set through the workbench user page would be overwritten by this mode.

- To make PPM Web application use single sign-on mode, set the following parameter:

  com.kintana.core.server.SINGLE_SIGN_ON_PLUGIN=com.kintana.sc.security.auth.SiteMinderSingleSignOn.

## Integration with a Client-Side Log-In Module

To complement the integration with client-side log-in module, follow these steps:

1. Develop a Java Authentication and Authorization Service (JAAS) log-in module that authenticates with the SSO system and receives an SSO token. The token could be set as a private credential in the Subject class.

   PPM has already provided such a module:

       com.kintana.sc.security.auth.SiteMinderLoginModule

2. Create the JAAS configuration file under the `$WebServiceToolkit/java/conf` directory

   Example:

       #authentication.conf
       SiteMinder {
       com.kintana.sc.security.auth.SiteMinderLoginModule required
       debug=true;}

3. Specify the JAAS login configure system property in the command lines used to invoke the Web services in the compile_client.bat file

   Example:

       java -Dclient.repository.dir=%WSCLIENT_HOME% -classpath
       %CPATH%
       -Djava.security.auth.login.config==%WSCLIENT_HOME%/conf/
       authentication.conf
       examples.pm.ProjectServiceClient https://localhost:8443/itg/
       ppmservices/ProjectService "kevin8"

4. Add logic in the Web service client to invoke JAAS login

   Examples:

       public Subject login() {
           LoginContext lc = null;
                lc = new LoginContext(
           " MyCustomModule ",
           myCallbackHandler
       );
           lc.login();
           return lc.getSubject();
           }

5. Add the SSO token as cookie in the Web service client.

   Examples: Set a HTTP cookie in axis2 Web service client.

       public void setSSOCookie(Stub stub, String ssoToken) {
                List headers = new ArrayList();

                //Set the required session variable for SSO system
                Header header = new Header(
                   "Cookie",
                   "SMSESSION=" + ssoToken
                  );
                headers.add(header);

                 ServiceClient client = stub._getServiceClient();
                 Options option = client.getOptions();
                 option.setProperty(HTTPConstants.HTTP_HEADERS,
       headers);
            }

6. Call the corresponding method to set the SSO cookie after a stub is created.

7. Make the desired Web service request with the SSO cookie you set.

https://admhelp.microfocus.com PPM 8942
Tips to improve your search results... OpenText™ Project and Portfolio Management Help Center PPM Help 26.2-26.3 All View Local Help Center View Online Help Center Version: