Home › Forums › Luminis Platform / System

Single sign on requirements

Thu, 2007-03-08 10:36 — bhill

Does anyone know what it takes to have single sign on capability with Luminis using AD as an authentication source? What components need to be in place? Right now my institution has ADAP and MOWA sceduled but is there anything else?

Thanks
Brandon

0
No votes yet
‹ Browser issues with attachments: III.2 and III.3 External Authentication (EAS) returned messages ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Thu, 2007-03-08 12:54 — cfont

you will need the following to start

you will need:

1) The External Authentication Server Implementation Guide [part of the Luminis Security SDK]
2) the host name(s) of your AD domain controllers [SGHE will tell you that you can only AuthN to one "ldap" server... ]
3) the port that AD's listening for ldap sessions [default is 389 unless you're doing ldap over ssl which is 636 (i think) and make sure the port is open through any potential firewalls between the luminis server and the DC]
4) An userid and password that can bind to AD, search for accounts, and verify passwords [I believe the userid should be the userPrincipalName attribute of the account that will be used for this purpose]
5) the Distinguished Name (DN) of the AD tree where you want to begin searching for user accounts [for example: DC=university,DC=edu]
6) the searching type is sAMAccountName
7) and knowledge/experience with LDAP and/or Active Directory would be very helpful ;)

In the configman settings you will need to decide upon a "prefix" to refer to the settings for "each" (what? i thought you said only one external ldap server...) server you want to work with. But the prefix must be prefixed with: security.ias.eas.jaas. and then you can choose a unique reference - perhaps it will be ldap or ad or ad1 or whatever. If you chose "ad" then the prefix will be: security.ias.eas.jaas.ad. and an example of one of the setting will be security.ias.eas.jaas.ad.host.name and another example will be security.ias.eas.jaas.ad.host.port - does that make sense?

I think this info will get you going. Read the EAS Guide and make sure you have some help from whomever manages Active Directory.