Integrating with BMC Helix Single Sign-On

Integrating BMC Client Management with

WarningSome content is unavailable due to permissions.

enables BMC Helix ITSM: Smart IT technicians to remote control BMC Client Management managed endpoints through the BCM browser-based console.

The BMC Helix Single Sign-On administrator typically provides the parameters needed to apply BMC Helix Single Sign-On settings in BMC Client Management. As a BMC Client Management administrator, ensure that the mandatory settings are met to ensure a successful integration.

To integrate with BMC Helix Single Sign-On, a BMC Client Management administrator must configure BMC Helix Single Sign-On parameters in the BMC Client Management console. After successfully configuring BMC Helix Single Sign-On with BMC Client Management, the BMC Helix ITSM: Smart IT administrator gets access to the BMC Client Management browser-based console to search for and remote control BMC Client Management managed devices.

Before you begin

As a BMC Client Management administrator who is integrating BMC Client Management with BMC Helix Single Sign-On, ensure that the following settings are met:

• BMC Helix Single Sign-Onparameter details
  • BMC Helix Single Sign-OnURL
  • Certificate Authority
  • Server Certificate

Mandatory settings

• The minimum supported version of BMC Helix Single Sign-On is 9.1.01 and later.
• The BMC Client Management master and the BMC Helix Single Sign-On server must be in the same domain. For example, if the BMC Client Management master server domain name is bcm.calbro.com, then the BMC Helix Single Sign-On domain name must be rsso.calbro.com.
• On the RSSO server, the realm used must have the master server DNS alias as one of the application domains. Following the above example, we must add bcm.calbro.com. 

• The BMC Client Management master server must have a reservation in DNS and must be accessed using that DNS name; otherwise, the integration fails and the following message is displayed: Forbidden request! Goto URL is wrong.

Considerations for configuring certificates

Communication between BMC Client Management and BMC Helix Single Sign-On can take place only over secured protocol (HTTPS). To enable communication by using HTTPS, you must obtain the HTTPS certificate from the BMC Helix Single Sign-On server.

You can supply a CA bundle that is trusted by your organization, pin the certificate downloaded from BMC Helix Single Sign-On, or use both.

A pinned certificate is more secure than a CA bundle; however, pinned certificates require more frequent renewal. BMC recommends that you use both a pinned certificate and a trusted CA bundle to verify the identity of the BMC Helix Single Sign-On server.

BMC Helix Single Sign-On parameters

As a BMC Client Management administrator, you must get the following settings from a BMC Helix Single Sign-On and SAML administrator. For parameters required to configure BMC Helix Single Sign-On and SAML with BMC Client Management, see BMC Helix Single Sign-On parameters.

To configure BMC Client Management to integrate with BMC Helix Single Sign-On

As a BMC Client Management administrator, you need the required parameters to configure BMC Helix Single Sign-On in BMC Client Management.

To apply the BMC Helix Single Sign-On settings, perform the following steps: 

1. In the BMC Client Management console, go to Global Settings > System Variables.
2. Select Single Sign On.
3. From the SSO Mode list, select RSSO, and enter the following parameter values:​​​​​​
   1. UI mode
   2. (For iFrame UI Mode) Additional Frame Src
   3. RSSO Server URL
   4. Realm ID
   5. Product Identifier
   6. RSSO Token revalidation period
   7. Certificate Authority Bundle
   8. Server Certificate
4. Click Verify.
5. Click Save Parameters.

Troubleshooting

Issue	Cause(s)	Resolution(s)
BMC Client Managementintegration with BMC Helix Single Sign-On not successful	Incorrect BMC Helix Single Sign-On parameters BMC Helix Single Sign-Onserver down	Contact BMC Helix Single Sign-On administrator
Cannot authenticate into BMC Client Management browser-based console	BMC Helix Single Sign-Onserver down Incorrect BMC Helix Single Sign-On credentials Incorrect configuration in BMC Client Management	Contact BMC Helix Single Sign-On administrator to ensure BMC Helix Single Sign-On server is up and running Contact BMC Client Management administrator to check whether BMC Helix Single Sign-On is correctly configured

Next step

Connect to the BMC Client Management browser-based console using BMC Helix Single Sign-On credentials