Home - Documentation for BMC Helix Single Sign-On 23.3

BMC

BMC Helix Single Sign-On 23.3

All versions

With BMC Helix Single Sign-On, your end users can present credentials for authentication only once in a multi software environment. Administrators enable single sign-on experience for applications, configure authentication methods, and review audit records.

Release notes and notices

updated 07 Sep

Learn what’s new or changed in this space, including urgent issues, documentation updates, service packs, and patches.

Tip

To stay informed of changes to this list, click the icon on top of this page.

Related topics

Known and corrected issues

Support information

Date	Summary	Reference
September 7, 2023	Enhancements available in this release: Automatic logout after inactivity for the configured time period Customize logout request templates for a smooth single logout process Enable liveness checks for Auth Proxy container Enhanced security for communication between BMC Helix SSO agents and BMC Helix SSO server	23.3 enhancements and patches
August 7, 2023	BMC Helix SSO version 23.2.01 is a maintenance patch.	23.3 enhancements and patches
July 6, 2023	Enhancements available in this release: Role based access for BMC Helix SSO Admin Console and REST API. Details for login source in audit records. Minimum password requirements available on pages to change or update passwords.	23.3 enhancements and patches
June 14, 2023	Updates available in 23.2 patch 2: BMC Helix SSO server containers have been moved to Java 17. This impacts the use of the SHA-1 signing algorithm for SAML IdP authentication.	23.2 enhancements and patches
May 9, 2023	Updates available in 23.2 patch 1: Configure the BMC Helix SSO agent to support immediate logout from all applications View details of the remote client IP address of the source in the audit records View statistics for administrator user activities	23.2 enhancements and patches
April 7, 2023	Enhancements available in this release: Configure realm identification for multiple service providers Enable access to additional user information for external services or integrated applications from the BMC Helix SSO server	23.2 enhancements and patches

Tip

Ready-made PDFs are available on the PDFs page. You can also create a custom PDF.

Click here to see the steps.

The BMC Documentation portal gives you the ability to generate PDF and Microsoft Word documents of single pages, and to create PDF exports of multiple pages in a space.

Creating PDF and Word exports

You can create a PDF of a page or a set of pages. (Non-English page exports are not supported.) You can also create a Word document of the current page.

To export to PDF or Word

From the Tools menu in the upper-right, select a format:
- Export to Word to export the current page to Word format
- Export to PDF to export the current page or a set of pages to PDF
If exporting to PDF, select what you want to export:
- Only this page to export the current page
- This page and its children to export a set of pages
For example, selecting This page and its children from the home page exports the entire space to PDF.

Getting started

Setting up BMC Helix SSO administrator accounts

Manage user accounts who will have access to BMC Helix SSO.

Configuring the BMC Helix SSO server

Configure the maximum session time for end users, enable the account lockout for administrators and audit records.

Setting up end user authentication

Configure authentication of end users through a specified authentication method.

Administering

Set up administrator accounts, activate tenants, and secure sensitive data.

Troubleshooting

Resolve common issues or errors, review logs, or contact BMC Customer Support.

Product trials

Communities

Knowledge Base

Videos

PDFs and videos

This topic describes and links to PDFs, videos and other documents that support this product release. If the ready-made PDFs of this space do not satisfy your requirements, you can export a custom PDF.

Ready-made PDFs of this space
Videos

Info

When you export a custom PDF, you can select the topics to include. For information about how you can export a custom PDF from this space, see Exporting to PDF and other formats.

Ready-made PDFs of this space

Log in or register to view the contents of this page.

Videos

The following table lists topics that contain videos that supplement or replace the text-based documentation.

Page:

Configuring Active Directory Federation Services as a SAML identity provider
Page:

Configuring Kerberos authentication
Page:

Configuring LDAP authentication
Page:

Importing configuration from an identity provider and configuring SAML
Page:

PDFs and videos

Frequently asked questions

Here are some answers to the most frequently asked questions about the BMC Helix Single Sign-On product.

Related topics

Troubleshooting

Frequently asked questions about BMC Helix Single Sign-On

An end user has modified the password, however the end user is still able to access BMC Helix SSO applications. Has the password been updated?

Identity providers do not automatically notify BMC Helix SSO about the password change. Hence, an end user's BMC Helix SSO session remains active until it expires, and is not revoked after password change on IdP. To force the logoff, and receive the request for entering a new password, an end user needs to ask a BMC Helix SSO administrator to delete all active sessions/OAuth of this end user.

How can I change my Helix SSO administrator password?

You can change your password in the BMC Helix SSO Admin Console, in the Admin User Management. To change your password, select your user account name, and then edit your password as required. See Setting up BMC Helix SSO administrator accounts for more details about how to change the password of an administrator.

I'd like to obtain BMC Helix SSO server version. How can I get that?

You can obtain the BMC Helix SSO server version information through the <RSSO Server>/config/server-status URL. You must be authenticated as a BMC Helix SSO administrator before that.

Is there a way to automatically retrieve OAuth metadata from the Helix SSO server?

Yes, you can do this.

If the OpenID Issuer URL is configured for the OAuth 2.0, developers of third-party applications can retrieve the OAuth metadata from the BMC Helix SSO server by using the following autodiscovery URL: RSSO_host:RSSO_port/rsso/.well-known/openid-configuration.

Running this request in the browser window returns details about the OpenID Connect provider's configuration, including the URIs of the authorization, token, revocation, userinfo, and public-keys endpoints.

Does BMC Helix SSO support multi-factor authentication?

Multi-factor authentication is not implemented on the BMC Helix SSO side. BMC Helix SSO only supports scenarios where the Identity Provider that is configured in BMC Helix SSO for authentication has configured multi-factor authentication.

For example, if your application is integrated with the BMC Helix SSO server that is configured to use the SAML protocol to authenticate users accessing an application, then for the end users to pass the authentication flow, multi-factor authentication must be enabled and configured on the SAML Identity Provider.

Does BMC Helix SSO provide options for auditing end-user actions?

Yes.

You can enable audit records for end-user events in the BMC Helix SSO Admin Console > General > Advanced > select the End-user events check box.

Frequently asked questions about the idle timeout

What if a page is minimized or hidden?

If the idle timeout value is reached, logout happens anyways.

What if the UI idle timeout Helix SSO script does not work for one of the integrated BMC applications?

If the UI idle timeout BMC Helix SSO script does not work for at least one of the applications, the idle timeout does not work for all of the applications.

What if applications have a different UI idle timeout period?

A warning message is shown for an application with the least UI idle timeout value first.

What if a user has got an infinite session?

Idle timeout is not applied.

What if the single logout option is not enabled in a realm?

A user is not logged out from all the applications, but only from the applications that reached the idle timeout value.