Configuring the BMC Atrium Single Sign-On server for AR System integration

1. On the SSO Server, navigate to Start > All Programs > BMC Software > BMC Atrium SSO > Administrator to launch the BMC Atrium SSO Admin Console and log on.
2. Click Edit BMC Realm to open the Realm Editor.
3. Set User Profile to Dynamic.
   
4. On the Realm Authentication panel, click Add.
5. Click AR.
   
   1. Enter the AR parameters.
   2. Click Save.
6. On the Realm Authentication panel, set the process order of the authentication chain:
   1. For the AR module, under Flag, select Sufficient.
   2. Select the AR module.
   3. Click Up so that AR is first in the list.
   4. Set Internal LDAP to Optional.
      
      Sufficient means that, with multiple authentication modules, if you are successfully authenticated with the first module, the remaining modules are skipped. But if the login fails, authentication moves to the next module in the chain. Setting AR to Sufficient and placing it as the first module in the list means that if you are authenticated with the AR System server, you are successfully authenticated by BMC Atrium Single Sign-On and you proceed to the Mid Tier.

      Note

      With Single Sign-On, you want to trigger authentication providers in the right order. The order is: Required > Requisite > Sufficient > Optional.
      If you set both realms to Required, then you would need both authentications to establish the session.
      For more information on creating an authentication chain, see the Realm Authentication panel described in Realm Editor.

AR parameters

1. On the User Stores panel, click Add.
   
2. Select AR User Store.
3. Enter the AR User Store parameters.
4. Click Save.

AR User Store parameters

BMC Atrium Single Sign-On provides basic user and group management features with the internal LDAP server. These features allow an administrator to manage users, groups, and memberships in the groups.

From the User page, the administrator can create, delete, and manage group memberships.

• To access the User page
• To add a new user

BMC products can use the group membership capabilities of the BMC Atrium Single Sign-On system to provide authorization and authentication of users. If a BMC product does not use the group memberships of the BMC Atrium Single Sign-On system, then that product's documentation must be consulted to determine groups to privileges mapping.

• To access the Group page
• To create a new group

To access the User page

Navigate to the following location:

1. Open the Realm Editor.
2. Click the Users tab.

New users can only be created when you are using the internal LDAP server for authentication. If an external source is used for authentication, new users must be created within that external system.

When creating a new user, each field that is marked with an asterisk is a required field.

To add a new user

1. In the Realm Editor, click the Users tab.
   Current AR System users created in your AR System server are already listed.
   
2. Click Add to open the User Editor.
   
3. In the User Id field, enter a unique identifier for the new user.
   This value is used as the user ID when the user logs in.
4. Specify the user's status.
   The default is Active.
5. Add the name attributes.
   • The name attributes (First Name, Full Name, and Last Name) can be provided to BMC products to help identify user accounts by using terms that are more user-friendly. The actual use of these attributes, though, is dependent on the BMC product.
   • You must assign an initial password of at least 8 characters when creating the account. After the password is created, the user can log into BMC Atrium Single Sign-On and update the password and their personal information through the following URL:
     https://FQDNHostName:port/BMC Atrium SSO?realm=BmcRealm
6. Click the Groups tab.
7. From the list of available groups, add the user to group membership (for example, BmcAdmins).
8. Click Save.

To access the Group page

BMC Atrium Single Sign-On provides predefined groups to help with the Administrator privileges that some BMC products might require. For example, the BmcSearchAdmin group provides privileges that allow a user to connect to the server to perform identity searches.

Navigate to the following location:

1. Open the Realm Editor.
2. Click the Groups tab.

To create a new group

Normally, BMC products install the groups that they need managed into BMC Atrium Single Sign-On as part of their installation. However, a situation might arise in which a group might need to be created or re-created.

1. In the Realm Editor, click the Groups tab.
   Current AR System groups created in your AR System server are already listed.
   
2. Click Add to open the Group Editor.
   
3. Enter a new, unique name for the group.
4. Add available users to the new group.
5. Click Save.