12 Replies Latest reply on Jul 18, 2018 2:14 AM by ABHISHEK ANAND

How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 12, 2018 8:07 AM

Hi Experts,

Need your kind assistance for the below requirement :-

How to integrate the RSSO 9.1.01 using the SAML authentication method for the existing AR & ITSM 8.1.01 v.........?

Early response will be highly appreciated.

Cheers

AA.

1. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

Ryan Nicosia Jul 12, 2018 10:47 AM (in response to ABHISHEK ANAND)

Did you read through the documentation:

Home - Documentation for Remedy Single Sign-On 18.05 - BMC Documentation

Basic process is as follows:

-Create Database for Remedy SSO
-Install Remedy SSO application on a server
-Configure Remedy SSO SAML authentication with AD Federated Services
-Create java keystore containing the self-signed cert
-Generate a server cert request
-Import the issued server cert and CA certificate chain into your keystore
-Configure tomcat to utilize SSL / HTTPS
-Configure Remedy SSO Realm
-Update the SP metadata at the Identity Provider
-Create the relying trust (AD team usually does this)
-Deploy SSO agents on AR System and Mid Tier

I think the most difficult part to get right is the configuration of the realm, SP metadata, and stuff on the A/D side. It took us several attempts to get this all working.
Like Show 0 Likes(0)

Actions
2. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 12, 2018 10:04 PM (in response to Ryan Nicosia)

Thanks Ryan for your kind response.
If possible please could you elaborate on points 3-7.
Like Show 0 Likes(0)

Actions
3. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 13, 2018 2:29 AM (in response to Ryan Nicosia)

Hi Ryan,

Please could you provide detail for the below points:-

-Configure Remedy SSO SAML authentication with AD Federated Services......?
-Create java keystore containing the self-signed cert.?
-Generate a server cert request?
-Import the issued server cert and CA certificate chain into your keystore?
-Configure tomcat to utilize SSL / HTTPS?
Like Show 0 Likes(0)

Actions
4. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

Sergey Smirnov Jul 13, 2018 2:58 AM (in response to ABHISHEK ANAND)

Which operating system is running ARS? Because the settings on *nix and windows for AD are a bit different
Like Show 0 Likes(0)

Actions
5. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 13, 2018 3:00 AM (in response to Sergey Smirnov)

Windows
Like Show 0 Likes(0)

Actions
6. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

Andrew Johnson Jul 17, 2018 1:10 PM (in response to ABHISHEK ANAND)

To elaborate on what Ryan was talking about.
-After Remedy SSO install, you must establish SSL configuration for tomcat
http://tomcat.apache.org/tomcat-7.0-doc/config/http.html
The link above will help you create a java keystore and a certificate request. The certificate request is used to get a trusted cert. This is necessary to establish a link with AD FS. keep in mind when creating the keystore and certificate that you use FQDN and match case. The server name must be consistent in the cert, java keystore, and URL entries.
-Create the Realm and select SAML authentication type
-Import the IdP (AD FS) login URL, will be supplied by an AD FS admin or Active Directory admin. it should auto fill most of the entries for SAML.
-Get metadata URL to import into AD FS/IdP. The AD FS server will only except if the SSL configured correctly on your RSSO server.
-You will have to create a relying trust which is covered in this article https://docs.bmc.com/docs/display/rsso1802/Integrating+IdP+with+Remedy+SSO+for+SAML+IdP+initiated+login
-you will also need to import your trusted cert from your RSSO server on the AD FS server
-export the AD FS certs (do not export the private key) then import those certs into the same java keystore

UPDATE: Sorry gave you the wrong link for Apache tomcat SSL configuration. http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
Like Show 0 Likes(0)

Actions
7. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 13, 2018 9:21 AM (in response to Andrew Johnson)

Thanks Andrew.

I will go through the steps provided & will keep all posted.
Like Show 0 Likes(0)

Actions
8. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 17, 2018 8:47 AM (in response to Andrew Johnson)

Hi Andrew,

I am exploring other options as well like LDAP authentication for RSSO but having some queries:-

1. Using the LDAP authentication can we directly navigate to ITSM home page or we have to provide the credentials in RSSO login page?
2. If we want to directly navigate to ITSM , is it possible please suggest?

Early response will be highly appreciated.

AA
Like Show 0 Likes(0)

Actions
9. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

Andrew Johnson Jul 17, 2018 9:24 AM (in response to ABHISHEK ANAND)

I am almost certain that LDAP requires credentials. According to BMC, "a realm is configured for an authentication method such as AR, LDAP, or Local, Which prompts users to provide their login name and password." https://docs.bmc.com/docs/x/Elh7Jw Kerberos and SAML are your options for direct authentication.
Like Show 0 Likes(0)

Actions
10. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 17, 2018 9:36 AM (in response to Andrew Johnson)

Thanks for your prompt response.

Also I am going through the Kerberos authentication method & bit stuck with below points:-

Machine name of the Key Distribution Center.
Kerberos realm created for Remedy SSO on Key Distribution Center.
Service account name for Remedy SSO.
Service account password if SPN credential type is to be used.
Keytab file if keytab credential type is to be used.

Please could anyone suggest on it.
Like Show 0 Likes(0)

Actions
11. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

Andrew Johnson Jul 17, 2018 1:08 PM (in response to ABHISHEK ANAND)

on your server or your machine on the network open up command prompt and type klist. maybe that will give you a clue of what the KDC realm is.
Like Show 0 Likes(0)

Actions
12. Re: How to integrate the RSSO 9.1.01 using the SAML authentication method

ABHISHEK ANAND Jul 18, 2018 2:14 AM (in response to Andrew Johnson)

Can anyone suggest which one is easy to implement & more robust:-

SAML or Kerberos as an authentication method for the RSSO.
Like Show 0 Likes(0)

Actions