Space banner


This documentation supports the 20.02 version of BMC Digital Workplace Advanced.

To view the latest version, select the version from the Product Version menu.

Configuring BMC Digital Workplace for Remedy Single Sign-On

Remedy Single Sign-On (Remedy SSO) is an authentication system for a multi-software environment that enables users to present credentials for authentication only once. After Remedy Single Sign-On authenticates the users, they can gain access to any other application with automatic authentication without providing the credentials again.

Remedy Single Sign-On supports the following authentication methods:

  • AR
  • SAML 2.0
  • LDAP
  • Kerberos
  • Certificate-based
  • Remedy Single Sign-On authentication or Local authentication
  • OAuth 2.0
  • OpenID Connect

Related topics

Remedy Single Sign-On 20.02 Open link

Setting up end user authentication Open link for information about authenticating with SAML, Kerberos, or LDAP


This topic describes how to configure the integration of Remedy Single Sign-On with BMC Digital Workplace .

Based on your organization’s requirement, you can configure any of the authentication methods to authenticate the users for various BMC applications.

As an administrator, you can integrate Remedy Single Sign-On with BMC Digital Workplace. After the integration, you can configure the required protocol for authentication. BMC does not support the Kerberos authentication for mobile apps, but you can configure the Kerberos authentication for web apps.

Remedy Single Sign-On authentication applies to browsers and mobile applications. When a user logs in on a mobile device, the user is prompted to enter the host name and port. If the server has SSO enabled, the mobile device opens a browser to the SSO login page. The SSO server sets the SSO cookies after authentication on the device browser. When the user relaunches the application, if the cookies are not expired, the mobile device displays the application. If the cookies are expired, the user is shown the login page again for authentication.

Before you begin

  • Install Remedy Single Sign-On and configure realms. For more information, see the Remedy Single Sign-On 20.02 Open link documentation.
  • Install BMC Digital Workplace.
  • Verify that access to the Remedy Single Sign-On servers and the BMC Digital Workplace server requires the same domain. Otherwise, deploying the Remedy Single Sign-On agent will not work.

Creating the file


If you are upgrading from a previous version of BMC Digital Workplace and you added custom configuration properties to the file, you must copy the custom configuration properties to the new file.

To integrate the BMC Digital Workplace with Remedy Single Sign-On , you need create the  file on the BMC Digital Workplace server.


If the file is missing, see KA 000372013 Open link .

Mappings required between the BMC Digital Workplace domain and Remedy Single Sign-On server

Before you create the  file, you should understand the mapping between the BMC Digital Workplace domain and Remedy Single Sign-On server ( <domain>:<url> ). Using this information, you will update the following properties in the file.



Remedy Single Sign-On agent redirects the browser (user’s request) to this URL when the Remedy Single Sign-On agent detects that one of the following happens:

  • The request needs to be authenticated.
  • The application logout is completed (that is, if the request refers to "logout-urls").

Remedy Single Sign-On agent uses this the URL to call the Remedy Single Sign-On web app APIs to perform the following tasks:

  • Retrieve configuration details, such as cookie name, cookie domain, and realm-domain mappings.
  • Check whether the token cookie from the browser (user's request) is valid and if it is valid, retrieve .
  • Register the Remedy Single Sign-On server to track other application agents. The tracking helps the agent to know the login status of other application agents prior to logging out.

To support multiple Remedy Single Sign-On servers on an agent, set the different values of the domain-to-server mapping as comma-separated strings. For example, assume that the Remedy Single Sign-On server for the domain “firstcompany” is and the Remedy Single Sign-On server for the domain “secondcompany” is Then, the properties definition will be the following:


To create the file

  1. (Windows) On the BMC Digital Workplace server, navigate to /opt/apache/tomcat8.5/external-conf.
    (Linux) On the BMC Digital Workplace server, navigate to /opt/bmc/DWP/DWP/tenant-config/scripts/linux.
  2. Create the file.
  3. Copy the following content to the file, and adjust the configuration values as required.

    # For the Agent Identifier, representing an application integrated with BMC Helix Single Sign-On, set application URL as its value.
    # The value should be the same on all nodes in same application cluster, but should be different for different applications.
    # e.g. agent-id = http://midtier-hostname/arsys
    # Application URL to trigger BMC Helix SSO logout, usually is redirected after application logout is completed
    # Application URL patterns NOT going through BMC Helix SSO web agent filter
    # If this property is set to true, the application context name will not be excluded for checking excluded url pattern
    # context-included=false
    # RSSO webapp external url for redirection
    # To support multiple RSSO webapps, set the value to a comma separated string: each represents a 'domain to server url' mapping, with the format of <domain>:<url>, 
    # e.g. domain1:https://server1:8443/rsso,domain2:https://server2:8443/rsso
    # RSSO webapp internal url for service call. Use HTTP instead of HTTPS protocol to avoid problems with handshake.
    # To support multiple BMC Helix SSO webapps, set the value to a comma separated string, each represents a 'domain to server url' mapping, with the format of <domain>:<url>, 
    # e.g. domain1:http://server1:8080/rsso,domain2:http://server2:8080/rsso
    # Time during that cached token status will be used without verified at BMC Helix SSO server side. Default value is 3 min.
    # token-status-cache-timeout=180
    # MSP-related flags
    # Flag to show realm-entry-page for the MSP deployments
    # msp-deployment=true
    # msp-always-show-domain-entry-page=true
    # To disable BMC Helix SSO agent just set value to true. In this case all requests will not being processed by BMC Helix SSO.
    # skip-filter=false
    # That property is mandatory for preauthentication. Put one of the following possible values: GET or POST
    # preauth-type=GET
    # Action path mask. If agent detects /_rsso in servlet path. Default value is: /_rsso
    # action-path-mask=/_rsso
  4. Save the changes.

  5. (Linux) Copy the domain-entry.jsp file from the Disk1/files/rsso-agent folder to the /opt/bmc/DWP/DWP/dwp folder.
  6. Restart the Tomcat server.

To integrate Remedy Single Sign-On with BMC Digital Workplace

For clusters, complete the following procedure for each BMC Digital Workplace server.

  1. Start the DWPTomcat service.
  2. Make sure that single sign-on integration is enabled in the BMC Digital Workplace database table by running the SQL query SELECT SAML_AUTHENTICATION from DWP_System.TENANT WHERE NAME = 'TENANT_NAME' where TENANT_NAME can be default 000000000000001 or custom, for example, 000000000000001-2
  3. If the response is False, complete one of the following options and proceed with steps 4 and 5:

  • (Windows) Open the set_env.bat file by following the path: \DWP\tenant-config\scripts\win, and set samlAuthentication to True.

(Linux) Open the file by following the path: /DWP/tenant-config/scripts/linux, and set samlAuthentication to True.

  • Run the following SQL query to update the value:

4. Stop the DWPTomcat service.

5. Restart the Tomcat service.

Was this page helpful? Yes No Submitting... Thank you


  1. Richard Cooke

    The 2nd link in the troubleshooting section is broken.

    Apr 15, 2021 10:36
    1. Ravee Panjwani

      Thanks for your comment, Richard Cooke. We will update the URL.

      Here's the topic that we meant to point to → Troubleshooting configuration for Remedy Single Sign-On integration.


      Apr 15, 2021 03:16