Server Configuration Editor

Cookies

Cookie Name

The cookie name is automatically created at installation, based on the fully qualified domain name (FQDN) of the BMC Atrium Single Sign-On host.

Cookie Domain

The default cookie domain value is the network domain of the computer on which you are installing the server. The default cookie domain specifies the most restrictive access. This value is used to control cookie visibility between servers within the domain. For more information about the default cookie domain, see Default cookie domain.

Select the HTTP Only check box to mark the BMC Atrium Single Sign-On cookie to prevent non-HTTP APIs such as JavaScript from accessing the cookie. For more information about the HTTP Only parameter, see  HTTP Only and HTTPS Only.

amAdmin

Password & Confirm Password

The password for accessing the BMC Atrium Single Sign-On server

External URL

None

FQDN for the BMC Atrium Single Sign-On server

Logging Level

None

Logging-level options:

• Off
• Error (returns the least information)
• Warning
• Message (returns the most information)

Enable FIPS-140

None

Configure FIPS-140 before enabling. See Configuring FIPS-140 mode.

Online Certificate Status Protocol

None

Common Access Card (CAC) can use Online Certificate Status Protocol (OCSP). If CAC is using OCSP, configure CAC before enabling. If CAC is not using OCSP, configuration is not required.
To enable, provide the server URL and select Enable OCSP.

Session

Max Session Time

Time after which your session is logged out, even when you are active. The time constraints are automatically enforced when this value is selected.

Default: 120 minutes

After the set maximum timeout value is reached, the user must close the browser and re-login into the system, irrespective of activity. The value for maximum session time is usually either 4 hours, 8 hours, or 12 hours.

Note: The Max Session Time value must be greater than the Idle Timeout value.

Idle Timeout

Time after which your session is logged out if you are inactive or away. The time constraints are automatically enforced when this value is selected.

Default: 30 minutes

Note: When you have integrated BMC Atrium Single Sign-On with BMC Remedy AR System, the BMC Atrium Single Sign-On Idle Timeout value must be 3 minutes more than the BMC Remedy Mid Tier Session Timeout (Minutes) value. For example, if the BMC Remedy Mid Tier timeout is set to 90 minutes, then BMC Atrium Single Sign-On idle timeout should be set to 93.

Cache Time

Time after which the cache is cleared. Time constraints are automatically enforced.

Default: 3 minutes

Max Session Count per User

Maximum number of concurrent sessions allowed for a user. Click Enable to enable Max Session Count per User.

Default: 5

Select the behavior to occur when the session limit is exceeded:

• Delete Oldest 
• Block New

The alias used to index the entry. You can click the alias to open the certificate details.

Details function is not represented as button action. To execute a details action, click the specified alias name in the Certificates table.

Use Import to add a certificate or private key pair to the keystores and truststores. When you click Import, the Upload Certificate Editor is displayed. Enter or upload the valid certificate details.

You can paste a PEM-encoded certificate, or browse to upload a PEM/DER-encoded certificate file or a PKCS12 file. You can also enter a host and port from which to capture a certificate. If you want to import a key pair, upload the PEM-encoded pairs or the PKCS12 file. When you select the PKCS12 file, an additional password field is provided, allowing you to enter the password for the KeyStore.

After you upload the certificate, verify the details in the Import Certificate Editor. Enter the alias for the certificate.

Note: If you want to update an existing certificate in the keystore or truststore, reimport it, add the same alias, and confirm the reimport process.

To delete the certificate, select it and click Delete.

Use to generate a new CSR. When you select a certificate key pair and click CSR, a new window with CSR details appears. You can then save the CSR details to a new file or copy the CSR details to send to the CA. You must then send this CSR to the Certificate Authority (CA) for digitally signing. The CA signs the CSR using a private key that validates the server's identity and returns a signed identity certificate.

The CSR is available only when you select a single key pair; it is disabled for truststores.

Use New to create a new certificate or a private key using the following parameters:

• Alias — Enter alias for the generated certificate. This value is generally the host name of the certificate. The owner DN must be a valid DN.
• Validity Period — Enter the number of days for which the certificate is valid. This value must be greater than 0.
• SAN — Enter the subject alternative names. SANs are semicolon-separated, valid, resolvable DNS host names.

Note: The New option is available for keystores only.

You can export a certificate or certificate key pair in PEM format. Select any certificate or key pair and click PEM. A new window with appears with the PEM certificate. You can then save the PEM details to a new file or copy the PEM details.

Note: You cannot export the private key using the PEM option. However, for the value with private key, you can export a certificate.