Configuring Remedy SSO agent
As an administrator of the server where an integration of Remedy Single Sign-On with an application is installed, you can configure the Remedy SSO agent by setting up properties in the rsso-agent.properties file.
Review the properties described in this topic to apply the required changes to the rsso-agent.properties file.
When properties in the rsso-agent.properties file are commented, the default values are used.
agent-id identifies an application integrated with Remedy SSO. You can specify any text value or an application URL for the
# e.g. agent-id = http://midtier-hostname/arsys agent-id=midtier_agent
If you have Remedy SSO deployed in high availability mode, then you must specify the same value as
agent-id on all nodes in the cluster.
However, you must not use the same value for integration with other applications, because the agent identifier must be unique per integration with other applications.
If the logout link generated by the application matches the
logout-urls pattern, then the Remedy SSO agent triggers the Remedy SSO logout flow when an end user initiates a logout from an application.
By default, the following configuration is applied:
# Application URL to trigger BMC Remedy Single Sign-On logout. logout-urls=/shared/loggedout.jsp
Excluded URL pattern
By setting the
excluded-url-pattern parameter, you can define which URLs must not go through the Remedy SSO web agent filter.
By default, the following configuration is applied:
Application context control
context-included property provides a means to enable or disable the option to check the application context by the Remedy SSO web agent filter.
To not exclude the application context from the
excluded-url-pattern, set the
context-included flag to
true. By default, the following configuration is applied:
Remedy SSO URLs
Server user-facing (external) and service (internal) URLs of the Remedy SSO server can be the same or different. Both of these URLs should point to the same server where Remedy SSO is deployed. Due to security reasons, user-facing URLs are protected by firewalls and an HTTPS connection.
Remedy SSO external URL
The Remedy SSO agent redirects the browser (user’s request) to the
sso-external-url when it detects one of the following events:
- The request needs to be authenticated.
- The application logout is completed (that is, if the request refers to
# RSSO webapp external url for redirection # To support multiple RSSO webapps, set the value to a comma separated string: each represents a 'domain to server url' mapping, with the format of <domain>:<url>, # e.g. domain1:https://server1:8443/rsso,domain2:https://server2:8443/rsso sso-external-url=https://yourcompany.com/rsso
Remedy SSO internal URL
The Remedy SSO agent uses the
sso-service-url parameter to call the Remedy SSO web application APIs to perform the following tasks:
- Retrieve configuration details, such as cookie name, cookie domain, and realm-domain mappings.
- Check whether the token cookie from the browser (user's request) is valid
- Register the Remedy SSO server to track other application agents. The tracking helps the agent to know the login status of other application agents prior to logging out.
Consider the following use case when you configure the value for the
To support multiple Remedy SSO web applications
Set the value to a comma separated string, each representing a domain to the server URL mapping, with the <domain>:<server url> format.
For more details about this use case, see Connecting the same Remedy SSO agent to different Remedy SSO servers.
Session token validation period
The Remedy SSO agent provides the configuration parameter for defining the time during which the cached session token remains valid without verification by the Remedy SSO server. By default, the
token-status-cache-timeout is 3 minutes (180 seconds):
Use in-memory cache
The Remedy SSO agent provides the configuration property that enables to choose between HTTP session and in-memory cache to store the token data.
By default, the in-memory cache option is disabled:
After you enable the in-memory cache, you must restart an application integrated with Remedy SSO.
To configure the Remedy SSO agent to expect JSON Web Token (JWT) in the authentication flow, set the
preauth-type parameter. Depending on how the third-party application sends a JWT to Remedy SSO, configure the Remedy SSO agent to expect JWT by HTTP
POST method. By default, the
GET method is configured:
Action path mask
Remedy SSO supports execution of some specific actions on behalf of applications integrated with Remedy SSO. Currently, only change password action is supported, which enables end users to change their passwords by accessing the Remedy AR System server from Remedy SSO:
The following setting is enabled by default in the rsso-agent.properties configuration file:
For more information about how to use this option, see Configuring the Remedy SSO agent to enable end users to change their passwords.
To display the realm entry page for MSP deployments, set the
msp-deployment flag to
true. The MSP page is displayed to end users in cases where the Remedy SSO server cannot identify to which realm an end user belongs.
To always display the realm entry page for MSP deployments, set the
# msp-deployment=true # msp-always-show-domain-entry-page=true
If you set the
true, you must set the
If you have Remedy SSO and an integrated application deployed on different domains, you must configure the Remedy SSO agent to support this deployment use case. For more information about this use case, see Deployment scenarios.
multi-domain-support property to
true to enable multi-domain support for the Remedy SSO agent, and then configure the values for
# multi-domain-support=true # oauth-client-id= # oauth-client-secret=
For more information about how to configure multi-domain support, see Configuring Remedy SSO for applications hosted on different domains.
To ignore the time difference between Remedy SSO agent and the Remedy SSO server, the
token-timeout-synchronization configuration property is provided. This property, set in seconds, specifies the time offset between the Remedy SSO server and the Remedy SSO agent.
This property is applicable only when multi domain support is enabled.
For example, if the Remedy SSO agent receives a token from the Remedy SSO server, and the token issue time according to the time set on the Remedy SSO agent is a future time, the Remedy SSO agent accepts the token without any errors.
token-timeout-synchronization is 10 seconds.
# token-timeout-synchronization = 10
Disabling the Remedy SSO agent
To disable the Remedy SSO agent, set the
skip-filter parameter to
# To disable Remedy SSO agent just set value to true. In this case the requests will not be processed by Remedy SSO. # skip-filter=false
If the RSSOAuthenticator in Mid Tier is used, perform the following steps to disable the Remedy SSO agent:
- From the <MT>/WEB-INF/classes directory, open the config.properties file.
- Set the following value for the
The Remedy SSO agent answers 401 Unauthorized with hidden
auto-post form to the /rsso/start page instead of 302 Redirect. This breaks the compatibility with some products, and hence to support an old-style behavior, the
redirect-mode parameter is used.
By default, its value is false and Agent answers 401 Unauthorized. If this value is true, the Remedy SSO agent switches back to the old-style 302 Redirect behavior.
To specify a URL to which the user must be redirected after the Remedy SSO completes the logout flow, set a value for the
callback-url property. For example, set the value as follows:
Alternatively, you can add the callback-url query parameter to the logout URL generated by the application, as shown in the following example:
Remedy SSO redirects an end user only to the same domain as the application domain after the completion of the logout process. For example, if the application domain is bmc.com, any combination of <URL>.bmc.com is allowed.
When both options are used, the callback-url as a query parameter has higher priority than the
callback-url property specified in the rsso-agent.properties file.
If you do not specify the
callback-url, and if you dot no specify the After logout URL for a realm in the Remedy SSO Admin UI, then the Remedy SSO server logout page is displayed to end users.
If you specify the After logout URL for a realm in the Remedy SSO Admin UI, end users are redirected to the specified URL page.