Server Configuration Editor

The Server Configuration Editor enables you to update the following parameters when you install or configure the BMC Atrium Single Sign-On server:

HTTP Only and HTTPS Only

With the release of BMC Atrium Single Sign-On 8.1 Patch 3, the Server Configuration Editor provides two new options: HTTP Only and HTTPS Only.

The HTTP Only parameter marks the BMC Atrium Single Sign-On cookie to prevent non-HTTP APIs such as JavaScript from accessing the cookie. When enabled, the HTTPS Only parameter marks the cookie with the Secure option, which ensures that the cookie is transmitted only over HTTPS connections from the browser to the server.

The default value of these check boxes is false. When set to true, these options prevent scripts and third-party programs from accessing the cookies.

To secure BMC Atrium Single Sign-On as a stand-alone server

1. Open the Edit Server Configuration tab on the BMC Atrium SSO Admin Console.
2. Select the HTTP Only and HTTPS Only check boxes, and click Save.
3. Restart the BMC Atrium Single Sign-On server.
4. Clear all cookies from the browser history.

To secure BMC Atrium Single Sign-On as a High Availability cluster

1. Open the HA Node Details tab on the BMC Atrium SSO Admin Console.
2. Select the node for which the HTTP Only and HTTPS Only options are to be enabled.

3. Select the HTTP Only and HTTPS Only check boxes for each node, and click Save. 

   Note

   Configuration warnings appear, telling you that the HTTP Only and HTTPS Only features are out of synch for some nodes. You can ignore the warnings and click OK.

4. Restart the server.
5. Clear all cookies from the browser history.