Unsupported content


This version of the product is in limited support. However, the documentation is available for your convenience. You will not be able to leave comments.

Configuring Remedy SSO agent

This topic was edited by a BMC Contributor and has not been approved.  More information.

As an administrator of the server where an integration of Remedy Single Sign-On with an application is installed, you can configure the Remedy SSO agent by setting up properties in the rsso-agent.properties file.

Review the properties described in this topic to apply the required changes to the rsso-agent.properties file.


When properties in the rsso-agent.properties file are commented, the default values are used.

Related topics

Remedy SSO agent


Troubleshooting authentication issues

SSL/TLS Configuration How-To Open link

Agent identifier

The agent-id identifies an application integrated with Remedy SSO. You can specify any text value or an application URL for the agent-id property. 

# e.g. agent-id = http://midtier-hostname/arsys

If you have Remedy SSO deployed in high availability mode, then you must specify the same value as agent-id on all nodes in the cluster. 

However, you must not use the same value for integration with other applications, because the agent identifier must be unique per integration with other applications. 

Logout URL

If the logout link generated by the application matches the logout-urls pattern, then the Remedy SSO agent triggers the Remedy SSO logout flow when an end user initiates a logout from an application.

By default, the following configuration is applied:

# Application URL to trigger BMC Remedy Single Sign-On logout.

Excluded URL pattern

By setting the excluded-url-pattern parameter, you can define which URLs must not go through the Remedy SSO web agent filter.

By default, the following configuration is applied:

# excluded-url-pattern=.*\\.xml|.*\\.gif|.*\\.css|.*\\.ico|/shared/config/.*|/WSDL/.*|/shared/error.jsp|/shared/timer/.*|/shared/login_commn.jsp|/shared/view_form.jsp|/shared/ar_url_encoder.jsp|/ThirdPartyJars/.*|/shared/logout.jsp|/shared/doc/.*|/shared/images/.*|/shared/login.jsp|/services/.*|/shared/file_not_found.jsp|/plugins/.*|/shared/wait.jsp|/servlet/GoatConfigServlet|/servlet/ConfigServlet|/shared/HTTPPost.class|/shared/FileUpload.jar|/BackChannel.*|/servlet/LicenseReleaseServlet.*

Application context control

The context-included property provides a means to enable or disable the option to check the application context by the Remedy SSO web agent filter.

To not exclude the application context from the excluded-url-pattern, set the context-included flag to true. By default, the following configuration is applied:

# context-included=false

Remedy SSO URLs 

Server user-facing (external) and service (internal) URLs of the Remedy SSO server can be the same or different. Both of these URLs should point to the same server where Remedy SSO is deployed. Due to security reasons, user-facing URLs are protected by firewalls and an HTTPS connection.

Remedy SSO external URL

The Remedy SSO agent redirects the browser (user’s request) to the sso-external-url when it detects one of the following events: 

  • The request needs to be authenticated.
  • The application logout is completed (that is, if the request refers to logout-urls).
# RSSO webapp external url for redirection
# To support multiple RSSO webapps, set the value to a comma separated string: each represents a 'domain to server url' mapping, with the format of <domain>:<url>, 
# e.g. domain1:https://server1:8443/rsso,domain2:https://server2:8443/rsso

Remedy SSO internal URL

The Remedy SSO agent uses the sso-service-url parameter to call the Remedy SSO web application APIs to perform the following tasks:

  • Retrieve configuration details, such as cookie name, cookie domain, and realm-domain mappings.
  • Check whether the token cookie from the browser (user's request) is valid
  • Register the Remedy SSO server to track other application agents. The tracking helps the agent to know the login status of other application agents prior to logging out.

Consider the following use case when you configure the value for the sso-service-url parameter:

To support multiple Remedy SSO web applications

Set the value to a comma separated string, each representing a domain to the server URL mapping, with the <domain>:<server url> format.


For more details about this use case, see Connecting Remedy SSO agent to multiple Remedy SSO servers.

Session token validation period

The Remedy SSO agent provides the configuration parameter for defining the time during which the cached session token remains valid without verification by the   Remedy SSO server. By default, the token-status-cache-timeout is 3 minutes (180 seconds):

# token-status-cache-timeout=180

Use in-memory cache

The Remedy SSO agent provides the configuration property that enables to choose between HTTP session and in-memory cache to store the token data.

By default, the in-memory cache option is disabled:

# use-in-memory-cache=false


After you enable the in-memory cache, you must restart an application integrated with Remedy SSO.


To configure the Remedy SSO agent to expect JSON Web Token (JWT) in the authentication flow, set the preauth-type parameter. Depending on how the third-party application  sends a JWT to Remedy SSO, configure the Remedy SSO agent to expect JWT by HTTP GET or POST method. By default, the GET method is configured:


Action path mask

Remedy SSO supports execution of some specific actions on behalf of applications integrated with Remedy SSO. Currently, only change password action is supported, which enables end users to change their passwords by accessing the Remedy AR System server from Remedy SSO:

The following setting is enabled by default in the rsso-agent.properties configuration file:

# action-path-mask=/_rsso

For more information about how to use this option, see Configuring the Remedy SSO agent to enable end users to change their passwords.

MSP functionality

To display the realm entry page for MSP deployments, set the msp-deployment flag to true. The MSP page is displayed to end users in cases where the Remedy SSO server cannot identify to which realm an end user belongs.

To always display the realm entry page for MSP deployments, set the msp-always-show-domain-entry-page to true.

# msp-deployment=true
# msp-always-show-domain-entry-page=true


If you set the msp-always-show-domain-entry-page to true, you must set the msp-deployment to true. 

Multi-domain support 

If you have Remedy SSO and an integrated application deployed on different domains, you must configure the Remedy SSO agent to support this deployment use case. For more information about this use case, see Deployment scenarios.

Set the multi-domain-support property to true to enable multi-domain support for the Remedy SSO agent, and then configure the values for auth-client-id and oauth-client-secret properties.

# multi-domain-support=true
# oauth-client-id=
# oauth-client-secret=

For more information about how to configure multi-domain support, see Configuring Remedy SSO for applications hosted on different domains.

Disabling the Remedy SSO agent

To disable the Remedy SSO agent, set the skip-filter parameter to true.

# To disable Remedy SSO agent just set value to true. In this case the requests will not be processed by Remedy SSO.
# skip-filter=false

If the RSSOAuthenticator in Mid Tier is used, perform the following steps to disable the Remedy SSO agent:

  1. From the <MT>/WEB-INF/classes directory, open the config.properties file.
  2. Set the following value for the arsystem.authenticator parameter:

Redirect mode

The Remedy SSO agent answers 401 Unauthorized with hidden auto-post form to the /rsso/start page instead of 302 Redirect. This breaks the compatibility with some products, and hence to support an old-style behavior, the redirect-mode parameter is used.

By default, its value is false and Agent answers 401 Unauthorized. If this value is true, the Remedy SSO agent switches back to the old-style 302 Redirect behavior.

# redirect-mode=true

Callback URL

To specify a URL to which the user must be redirected after the Remedy SSO completes the logout flow, set a value for the callback-url property. For example, set the value as follows:


Alternatively, you can add the callback-url query parameter to the logout URL generated by the application, as shown in the following example:



Remedy SSO redirects an end user only to the same domain as the application domain after the completion of the logout process. For example, if the application domain is bmc.com, any combination of <URL>.bmc.com is allowed.

When both options are used, the callback-url as a query parameter has higher priority than the callback-url property specified in the rsso-agent.properties file.

If you do not specify the callback-url, and if you do not specify the After logout URL for a realm in the Remedy SSO Admin UI, then the Remedy SSO server logout page is displayed to end users.

If you specify the After logout URL for a realm in the Remedy SSO Admin UI, end users are redirected to the specified URL page.

Was this page helpful? Yes No Submitting... Thank you


  1. Saurabh Maheshwari

    Please check troubleshooting link for SSL connection. As per this link https://docs.bmc.com/docs/rsso1908/troubleshooting-common-errors-and-issues-879743344.html

    if you have an integration with BMC Remedy AR System, you must additionally set the system property com.bmc.rsso.tls.disable.checks to true for AREA plugin in rsso.cfg available in \ARSystem\Conf on Remedy AR System server

    Nov 09, 2019 10:58
    1. Olga Kutetska

      Saurabh Maheshwari, thank you for the comment. Would you, please, clarify what you wanted to say. I a not sure if you tried to bring our attention to a problem or you had some suggestion?

      Mar 18, 2020 06:51