This documentation supports the 11.2 version of BMC Discovery.

To view an earlier version of the product, select the version from the Product version menu.

Integrating with Remedy Single Sign-On

Remedy Single Sign-On (Remedy SSO) is an authentication system that supports various authentication protocols such as LDAP and provides single sign-on for users of BMC products. For more information about Remedy SSO, including installation and configuration, see Remedy SSO overview in the Remedy Action Request System 9.1 online documentation.

Note

Integration with BMC Atrium Single Sign-On was deprecated in BMC Discovery 11.0 and will be removed in a future release. You should use the integration with Remedy SSO.


To integrate BMC Discovery with Remedy SSO, you must first configure the Remedy SSO server and then enable the integration.


See this video (05:42) for an overview of how the integration between Remedy Single-Sign On and BMC Discovery takes place.

 https://www.youtube.com/embed/tmER3CFf6ZI?rel=0

Before you begin

Before you begin integrating BMC Discovery with Remedy SSO, ensure that following considerations are in place:

Mandatory settings

Ensure that following settings are in place:

  • The minimum supported version of Remedy SSO is 9.1.01 and later, fully tested up to 18.11.00.

  • BMC Discovery and the Remedy SSO server must use the same LDAP server. Otherwise, BMC Discovery is unable to check user permissions even if the user has successfully logged in through Remedy SSO.
  • The BMC Discovery appliance and the Remedy SSO server must be in the same domain; for example, if your BMC Discovery domain name is discovery.calbro.com, your Remedy SSO domain name must be rsso.calbro.com, (not rsso.calbro-internal.com).
  • The BMC Discovery appliance must have a reservation in DNS and must be accessed using that DNS name; otherwise, the integration fails and the following message is displayed: Forbidden request! Goto url is wrong.
  • Contact your Remedy SSO administrator for the parameters required in the following procedure: RSSO Server URL, RSSO Realm ID, RSSO Agent ID, and RSSO Token revalidation period.

Considerations for configuring certificates

Communication between BMC Discovery and Remedy SSO can take place only over secured protocol (HTTPS). To enable communication by using HTTPS, you must obtain the HTTPS certificate from the Remedy SSO server.

You can supply a CA bundle that is trusted by your organization, pin the certificate downloaded from Remedy SSO, or use both.

A pinned certificate is more secure than a CA bundle; however, pinned certificates require more frequent renewal. BMC recommends that you use both a pinned certificate and a trusted CA bundle to verify the identity of the Remedy SSO server.

Configuring the connection to Remedy SSO server

Before you configure the connection to the Remedy SSO server, ensure that the LDAP settings are configured and you are able to log in to the BMC Discovery appliance as an LDAP user with administrative privileges. After you activate the Remedy SSO integration, as an administrator, you can log in again and change the configuration, if required.

To apply the Remedy SSO settings, you must perform following steps:

  1. On the main menu, click the Administration icon
  2. In the Security section, click Single Sign On
    By default, the Remedy SSO tab opens.
  3. On the Remedy SSO tab, enter the following parameters:

    Parameter nameDescription
    RSSO Server URLEnter the URL for the Remedy SSO server. The Remedy SSO server URL must begin with https and have the same domain as the BMC Discovery appliance. For example, use discovery.calbro.com and rsso.calbro.com (not discovery.calbro.com and rsso.calbro-internal.com).
    RSSO Realm ID

    A realm is a virtual identity provider used to authenticate a domain. Contact your Remedy SSO administrator for the Realm ID.

    RSSO Agent IDContact your Remedy SSO administrator for the Agent ID.
    RSSO Token revalidation periodEnter the revalidation period in minutes. For more information, contact your Remedy SSO administrator. 
    RSSO server timeoutEnter the server timeout in seconds. BMC Discovery administrator needs to monitor this parameter and accordingly increase or decrease the number of seconds required for the RSSO server to respond.
  4. Click Save.

Uploading a CA bundle

BMC recommends that you upload a trusted CA bundle. Trusted CA bundles enable you to validate the Remedy SSO server certificate.

  1. In the Trusted CA section, click Choose File and select the CA bundle file from your local file system.
  2. Click Upload CA Bundle.
    The new certificate bundle is uploaded.

Pinning an HTTPS certificate

The following section explains how to pin an HTTPS certificate:

  1. Download the HTTPS certificate by clicking Get certificate from server.
    After the certificate is downloaded, details such as Fingerprint, Validity dates, and certificate content are displayed. 
  2. After the certificate is retrieved from the server and you have verified that it exactly matches the certificate on the Remedy SSO server, click the Pin certificate button.
    Certificate pinning involves additional security measures of certificate checks. BMC Discovery administrator must check the channels through which the certificate is received. 
    If the server certificate and the uploaded certificate are not identical, click Unpin Certificate and upload a valid certificate. 

After the configuration completes successfully, the Enable button becomes available. The HTTPS certificate validity is subject to a baseline check. A baseline alert is raised five days before the certificate expires.

For information about troubleshooting Remedy SSO configuration in BMC Discovery, see troubleshoot.

Enabling Remedy SSO Integration

To enable the Remedy SSO integration, click Enable.

Troubleshooting 

If you are unable to log in to BMC Discovery by using Remedy SSO, use the local login URL to access the BMC Discovery UI and log in as a local user.

http://ip-address/ui/LocalLogin

Related topics

Was this page helpful? Yes No Submitting... Thank you

Comments