Setting up SAMLv2 authentication in Remedy SSO
You can configure the Remedy Single Sign-On server to authenticate TrueSight Operations Management users through a SAML authentication.
Upgrade warning
If you have the App Visibility Manager version 11.0.00.003 (Fix Pack 3) configured to work with the SAML authentication type, and want to upgrade your TrueSight Operations Management to version 11.3.01, you must also apply the Fix Pack version 11.3.02 for the SAML authentication type to work.
Before you begin
- You must have installed and configured the Remedy SSO to work with the Presentation Server and its component products. For details, see Planning to deploy Remedy SSO and Installing Remedy Single Sign-On.
- You must have created an equivalent local user(and its associated local usergroup) for every SAML user that needs to log into the Presentation Server. This is required because the Remedy SSO server cannot obtain usergroup information from the SAML IdP for the successfully logged in SAML user. Therefore, you need to create an equivalent local user with the exact name as the SAML user and associate that local user with the desired local usergroup. For details on creating local users and usergroups in Remedy SSO using the import utility, perform the Migrating internal user data from Atrium SSO to Remedy SSO procedure.
- You must have added a non-default tenant (realm) in addition to the default * tenant (realm). Configuring tenants for the Presentation Server in Remedy SSO.
You must have configured a multi-tenant environment by enabling the msp parameter. For enabling multi-tenancy, see To enable multi-tenancy in Presentation Server.
Note
SAML cannot be configured using the * (default realm) tenant.
Configuring SAMLv2 authentication in Remedy SSO
Note
- The TrueSight REST API calls are not supported for SAML users.
- Service Provider (SP) and Identity Provider (IdP) initiated SAML logins are supported.
To configure the SAMLv2 authentication in Remedy SSO for the TrueSight Presentation Server
Log in to the Remedy SSO Admin console.
In the left navigation panel of the Add Realm or Edit Realm page, click Authentication.
In the Authentication Type field, click SAML.
Enter the SAML details. For more information on parameters, see SAMLv2 authentication parameters.
Important
When you configure the SAML authentication parameters for the Presentation Server, you must set the User ID Transformation field to RemoveEmailDomain and enable the Force Authentication check box.
Click Save.
In the left navigation panel of the Add Realm or Edit Realm page, click Authentication.
In the Authentication Type field, click SAML and click Enable Chaining Mode.
- Click Add Authentication.
- In the Authentication Type field, click LOCAL.
- Enter the LOCAL details. For more information on parameters, see LOCAL authentication parameters.
- Create users and user groups for the LOCAL authentication.
The users in LOCAL should be exactly same as the users in SAML.
Alternatively, the users can also be created using import script under the migration utility. - Associate users to the user groups.
- Click Save.
Important
Add the LOCAL authentication entry below the SAML authentication entry, and do not promote or move the LOCAL entry above the SAML entry.
Notes
- For the alternative way to create users in step#11 using the import script, see Migrating internal user data from Atrium Single Sign-On to Remedy Single Sign-On.
- The user groups created in step#12 is used when you create the authorization profile.
To add SAMLv2 referrer host to the Presentation Server
Run the following commands from the Presentation Sever command prompt to configure the SAMLv2 referrer host name:
tssh properties set
tspsProxyHosts <SAMLv2_referrer_FQDN_host_
name>,<remedy_sso_FQDN_host_
name>
tssh properties reload
To add SAMLv2 referrer host to the Infrastructure Management Server
Log in to the Infrastructure Management server as an Administrator and perform the following steps:
- Open the pronet.conf file located at the installationDirectory\pw\custom\conf directory.
- Add the SAML referrer host name (FQDN format) to the pronet.conf pronet.tsim.proxy.hosts= <SAMLv2 referrer FQDN host name>,<Remedy_SSO_FQDN_host_name> property.
- Save the file changes.
- Run the following command to reload the properties:
pw jproperties reload
To create or edit an authorization profile with SAML users in the Presentation Server
- Log in to the TrueSight console as a Super Admin.
- Navigate to Administration>Authorization Profiles.
- Create a new authorization profile or edit an existing authorization profile to associate the user groups.
Select a tenant other than the * (asterisk) tenant that you configured in Remedy Single Sign-On for SAML users and select Edit under User Groups.
Note
Do not select the * (asterisk) tenant for the SAML users.
- Click Add and select the SAML user group from the list of user groups.
- Select the required roles from the list roles.
- (Optional) Select the required objects from the list of object.
- Select OK and then Save.
- Select Yes to confirm changes to the authorization profile.
- Log out of the TrueSight console.
Log in to the TrueSight console as a SAML user.
A two-step authentication screen is displayed.Type the SAML realm Application Domain name and click Submit.
The SAML login screen is displayed.- Type the SAML login credentials and click Login.
The TrueSight console is displayed.
Comments
Log in or register to comment.