Setting up Kerberos authentication in Remedy SSO

Remedy Single Sign-On (Remedy SSO) supports Kerberos authentication.You can configure the Remedy Single Sign-On server to authenticate TrueSight Operations Management users through a Kerberos authentication.

The following topics help you to perform the above tasks in Remedy SSO and create an authorization profile in the TrueSight console:


Related topics

Setting up the Remedy SSO server

Configuring tenants in Remedy SSO

To enable multi-tenancy in Presentation Server

Managing authorization profiles

Role-based access

Before you begin

  • You must have installed and configured the Remedy SSO to work with the Presentation Server and its component products. For details, see  Planning to deploy Remedy SSO  and  Installing Remedy Single Sign-On.
  • You must have created an equivalent local user(and its associated local usergroup) for every Kerberos user that needs to log into the Presentation Server. This is required because the Remedy SSO server cannot obtain usergroup information from the Kerberos identity provider for the successfully logged in Kerberos user. Therefore, you need to create an equivalent local user with the exact name as the Kerberos user and associate that local user with the desired local usergroup. For details on creating local users and usergroups in Remedy SSO using the import utility, perform the  Migrating internal user data from Atrium SSO to Remedy SSO  procedure.
  • You must have added a non-default tenant (realm) in addition to the default * tenant (realm). Configuring tenants for the Presentation Server in Remedy SSO.
  • You must have configured a multi-tenant environment by enabling the msp parameter. For enabling multi-tenancy, see To enable multi-tenancy in Presentation Server.

    Note

    Kerberos cannot be configured using the * (default realm) tenant.

  • Create a service account in Active Directory and configure the Service Principal Name (SPN)

  • Obtain the following information:

    • Host name of the Key Distribution Center (KDC)
    • Kerberos realm created for Remedy SSO on Key Distribution Center
    • Service account name for Remedy SSO
    • Service account password if SPN credential type is to be used
    • Keytab file if keytab credential type is to be used


Configuring Active Directory 

To configure Active Directory, perform the following steps:

#StepPerformed by
1Create a service account in Active DirectoryActive Directory administrator
2Add an SPN mapping for the service accountActive Directory administrator
3

(Optional) Generate a keytab file if you want to provide the credentials through a keytab file 

User who access to a server with the domain controller

Creating a service account in Active Directory 

  1. Go to Active Directory.
  2. Right-click Users > New > User.
  3. Enter the user name and the user logon name in the First name and User logon name fields.
  4. Click Next.
  5. Enter user password in the Password and Confirm password fields.
  6. Select the User cannot change password and Password never expires check boxes.
  7. Click Next.
  8. Click Finish.

Adding an SPN mapping for the service account 

Before you begin

  • Ensure that you have the user name and password for the service account.
  • Ensure that you have the machine name where Remedy SSO server runs.

To add an SPN mapping

To add an SPN mapping, run the setspn command on one of the directories in the Active Directory machine.

setspn -S HTTP/<HOST> <USER> 

For more information about the setspn command parameters, see the following list:

  • <HOST>: Fully qualified domain name of the host on which Remedy SSO server runs including the internet domain.

  • <REALM>: Name of the Kerberos realm.
  • <USER>: Logon name of the service account.

For example,

setspn -S HTTP/access.bmc.com remedyssoservice

(Optional) Generating a keytab file 

A keytab contains the Service Principle Name (SPN) credentials for Remedy SSO to communicate with the domain controller. The clients use the SPN to request a service ticket during the authentication process.

Before you begin

  • Obtain the user name and password for the service account.
  • Obtain the machine name where Remedy SSO server runs.
  • Ensure that you have appropriate administrative permissions to run the ktpass command.

To generate a keytab file

To generate a keytab file, run the ktpass command on the command line interface in an appropriate directory. The command automatically assigns HTTP/<host> SPN to the user.

ktpass /out <FILE> /princ HTTP/<HOST>@<DOMAIN> /pass <PASSWORD> /crypto ALL /ptype KRB5_NT_PRINCIPAL /Target <DOMAIN> /kvno 0

For more information about the ktpass command parameters, see the following list:

  • <FILE>: Name of the keytab file that is to be generated.
  • <HOST>: Fully qualified domain name of the host on which Remedy SSO server runs including the internet domain.
  • <DOMAIN>: Active Directory domain name written in uppercase.
  • <PASSWORD>: Password of the user.

For example,

ktpass /out c:\remedyssoservice.keytab /princ HTTP/access.example.com /crypto ALL /pass RemedySs0service /ptype KRB5_NT_PRINCIPAL /Target RSSO.COM /kvno 0

Configuring Kerberos authentication in Remedy SSO for the TrueSight Presentation Server

Perform the following procedures to configure the Kerberos authentication for TrueSight Presentation Server:

To configure the Kerberos authentication in Remedy SSO for the TrueSight Presentation Server

  1. Enter the Kerberos details. For more information on parameters, see Kerberos authentication parameters.

    Important

    When you configure the Kerberos authentication parameters for the Presentation Server, you must set the User ID Transformation field. For example, if your User ID Format value is domain\user or user@domain, you must set the User ID Transformation to RemoveDomain.

  2. Click Test to verify the settings.
  3. Click Save.
  4. Click Add Authentication.
  5. In the Authentication Type field, click LOCAL.
  6. Enter the LOCAL details. For more information on parameters, see LOCAL authentication parameters.
  7. Create users and user groups for the LOCAL authentication. 
    The users in LOCAL should be exactly same as the users in Kerberos identity provider.
    Alternatively, the users can also be created using import script under the migration utility.
  8. Associate users to the user groups.
  9. Click Save.

Important

 Add the LOCAL authentication entry below the Kerberos authentication entry, and do not promote or move the LOCAL entry above the Kerberos entry.

Notes

    MultiExcerpt named 'rsso_config_kerberos' was not found
The multiexcerpt named 'rsso_config_kerberos' was not found. Please check the page name and MultiExcerpt name used in the MultiExcerpt Include macro.

To create or edit an authorization profile with Kerberos users in the Presentation Server

  1. Log in to the TrueSight console as a Super Admin.
  2. Navigate to Administration>Authorization Profiles.
  3. Create a new authorization profile or edit an existing authorization profile to associate the user groups.
  4. Select a tenant other than the * (asterisk) tenant that you configured in Remedy Single Sign-On for Kerberos users and select Edit under User Groups

    Note

    Do not select the * (asterisk) tenant for the Kerberos users.

  5. Click Add and select the Kerberos user group from the list of user groups.
  6. Select the required roles from the list roles.
  7. (Optional) Select the required objects from the list of object.
  8. Select OK and then Save.
  9. Select Yes to confirm changes to the authorization profile.
  10. Log out of the TrueSight console.
  11. Configure the browsers for Kerberos authentication to work.
  12. Log in to the TrueSight console as a Kerberos user.
    A two-step authentication screen is displayed.

  13. Type the Kerberos realm Application Domain name and click Submit.
    The Kerberos login screen is displayed.

  14. Type the Kerberos login credentials and click Login.
    The TrueSight console is displayed.

Configuring the browsers

After you have configured the Active Directory and Kerberos authentication settings, you must make sure that the browser on a user's system is configured to use Kerberos authentication. Ensure that the browser is not on the same computer on which you have installed Remedy SSO server.

Note:

Google Chrome also supports Kerberos authentication. If you have configured Internet Explorer, then no additional settings are required for Google Chrome because it uses Internet Explorer settings.

Configuring Internet Explorer

  1. Navigate to Tools > Internet Options > Advanced.
  2. On the Advanced tab and in the Security section, select Enable Integrated Windows Authentication (requires restart).
  3. On the Security tab, select Local Intranet.
  4. Click Custom Level.
  5. In the User Authentication/Logon section, select Automatic logon only in Intranet zone.
  6. Click OK.
  7. Click Sites and select all check boxes.
  8. Click Advanced and add the Remedy SSO service website to the local zone (the website might be already added). For example, sample.bmc.com.
  9. Click Add.
  10. Click OK for all pop-ups.

Configuring Mozilla Firefox

  1. Enter the following URL: about:config.
  2. Click I'll be careful, I promise!
  3. Double-click the Preference Name: network.negotiate-auth.trusted-uris.
  4. Add the Fully Qualified Domain Name (FQDN) of the host, for example, sample.bmc.com.
  5. Double-click the Preference Name:  network.automatic-ntlm-auth.trusted-uris.
  6. Add the fully qualified domain name (FQDN) of the host, for example, sample.bmc.com.
  7. Click OK.

Related topics

Kerberos authentication workflow

User ID transformation

Troubleshooting authentication issues

Was this page helpful? Yes No Submitting... Thank you

Comments

  1. Anthony Valuikas

    The screenshot under 4. shows your Kerberos realm with all of the truesight groups. When configuring Kerberos authentication you end up with * and all of the groups to get started. Now Kerberos wants a different realm. On the new realm how/where do you configure it access to the truesight groups like * has? I do not see anything in the documentation about that.

    Aug 17, 2020 03:53
    1. Harihara Subramanian

      Hello Anthony Valuikas,


      Did you check these two topics?

      Configuring user authentication for the Presentation Server in Remedy SSO

      Configuring tenants for the Presentation Server in Remedy SSO


      In addition, you might also want to check these two topics and their children topics.


      Specifying objects

      Managing roles

      Let me know if that helps.



      Oct 28, 2020 01:54