Single Sign on With MS Active Directory-TCS

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Temenos Support Forum (/SitePages/tsf.asp (/SitePages/tsf.aspx) x)

Portal Help

Inlaks

Customer Support Portal (/SitePages/Home.aspx)

"

MENU

Entire Site

!

Enter your keywords here

Single Sign on with MS Active Directory-TCS Introduction T24 Browser is a web application used to access T24. GenerallyT24 Browser requires user credentials like username, password to allow a user to log into T24 browser. With this enhancement, Single Sign on of T24 Browser with Microsoft Active Directory is implemented.

Application Overview Overview This document is aimed at providing guidance to con !gure the Tcserver, TCClient f or or enabling Single Sign On to T24 Browser with Active Directory server. Note: We have implemented using ADAM server. Schema management for ADAM and Active Directory are same. ADAM supports supports both X.500-style and Domain Name System (DNS)-style distinguished names for top-level directory partitions. (/SitePages/Home.aspx) spx) # (/SitePages/Home.a

Setting Set ting up the System

$ (/SitePages/TicketingSystem.aspx ) !

Software required:

1. ADAMSP1_x86_English (/TCSPProﬁleCenter/infodefault.aspx) /infodefault.aspx) % (/TCSPProﬁleCenter 2. TCServer (latest version 1.5.2 _17)

& (/Support/DashBoar (/Support/DashBoard.aspx) d.aspx) 3. BrowserWeb.war

4. Web Server or Application Server 5. JXplorer TCServer version should be 1.5 and patch version should be greater than the 1.5.2_16 Download ADAM server from the b elow hyperlink http://www.microsoft.com/down http://www.mi crosoft.com/downloads/details.aspx?fa loads/details.aspx?familyid=9688f8b9-1034-4ef6-a3e5-2a2a57b5c8e4&displaylang=en milyid=9688f8b9-1034-4ef6-a3e5-2a2a57b5c8e4&displaylang=en (http://www.mi (http://www.microsoft.com/downl crosoft.com/downloads/details.aspx? oads/details.aspx? familyid=9688f8b9-1034-4ef6-a3e5-2a2a57b5c8e4&displaylang=en) Web server or Application Server can be used. Web Server – Tomcat 6.0 App Server – JBOSS 4.2.3.GA

Installing ADAM You can install an ADAM instance either by using the Active Directory Application Mode Setup Wizard or by using the ADAM unattended installation process. In the

!rst

exercise, exercise, you use the Active Directory Application Mode Setup Wizard to install ADAM.

Note Not e To install ADAM, you must log on to your computer using an account that belongs to the local Administrators group. In this exercise, you !rst install ADAM, and then you install an ADAM instance by using the Active Directory Ap plication Mode Setup Wizard. To install ADAM 1. To install install ADAM, log on as an an administrator, administrator, click Start, Start, point to Control Panel, Panel, and then click Add or Remove Programs. Programs. 2. Click Add/Remove Windows Components. Components . 3. Select the check box next to to Active Directory Services, Services , and then click Details. Details. 4. Select the check box next to to Active Directory Application Mode (ADAM) , click OK, OK, and then click Next. Next. 5. Review the message message that appears. Based on the contents contents of message, do one of the following: ·

If the message "You "You have successfully successfully completed the the Windows Component Component Wizard" appears, click click Finish. Finish.

·

If an error message appears, make a note note of the error, click Finish, Finish, and then review the ADAM event messages in Event Viewer.

To install an ADAM instance by using the Active Directory Application Mode Setup Wizard 1. To start the the Active Directory Directory Application Mode Setup Setup Wizard, click Start, Start, point to All Programs, Programs, point toADAM to ADAM,, and then click Create an ADAM instance. instance . The !rst page of the Active Directory Application Mode Setup Wizard looks like the following:

Was this page helpful?

877DEF##7:EDG74H415EG:5H#I56@5#/01234/02151GBEDJ

Yes

No

-B24 " 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

2. On the Welcome to the Active Directory Application Mode Setup Wizard page, click Next. Next . 3. On the Setup Options page, Options page, you can choose whether to install a unique ADAM instance or join an existing con !guration set. Because you are installing the

!rst ADAM

instance, click A unique instance (as shown in the following), and then click Next. Next. Later, you will create additional ADAM instances and join them in a con !guration set.

4. On the Instance Name page, Name page, provide a name for the ADAM instance that you are installing. installing. This name is used on the local computer to uniquely identify the ADAM instance. For this exercise, simply accept the default name of instance1, and then click Next. Next.

5. On the Ports page, Ports page, specify the communications ports that the ADAM instance uses to communicate. ADAM can communicate using both LDAP and Secure Sockets Layer (SSL); therefore, you must provide a value for each port. For this exercise, accept the default values of 389 and 636, and then click Next. Next .


-B24 & 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Note If you install ADAM on a computer where either of the default ports is in use, the Active Directory Application Mode Setup Wizard automatically locates the !rst available port, starting at 50000. For example, Active Directory uses ports 389 and 636, as well as ports 3268 and 3269 on global catalog servers. Therefore, if you install ADAM on a domain controller, the Active Directory Application Mode Setup Wizard provides a default value of 50000 for the LDAP port and 50001 for the SSL port. 6. On the Application Directory Partition page, you can create an application directory partition (or naming context) by clicking Yes, create an application directory partition. Or, you can click No, do not create an application directory partition , in which case you must create an application directory partition manually after installation. For this exercise, click Yes, create an application directory partition. When you create an application directory partition, you must provide a distinguished name for the new partition. For this exercise, type O=Temenos,C=IN as the distinguished name (as shown below), and then click Next.

Note ADAM supports both X.500-style and Domain Name System (DNS)-style distinguished names for top-level directory partitions. 7. On the File Locations page, you can view and change the installation directories for ADAM data and recovery (log)

!les. By default, ADAM data and recovery !les

are

installed in %ProgramFiles%\Microsoft ADAM\ instancename \data, where instancename represents the ADAM instance name that you specify on the Instance Name page. For this exercise, click Next to accept the default !le locations.


-B24 ! 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Important When installing ADAM on a computer running Windows XP, you must install these

!les on the same logical volume. When installing ADAM on Windows Server 2003 and

Windows Server 2003 R2 in a production environment, it is recommended that you install the

!les on separate physical disks.

Note ADAM setup installs program !les and administration tools in %windir%\ADAM. 8. On the Service Account Selection page, you select an account to be used as the service account for ADAM. The account that you select determines the security context in which the ADAM instance runs. Unless you are installing ADAM on a domain controller, the Active Directory Application Mode Setup Wizard defaults to the Network Service account. For this exercise, click Next to accept the Network service accountdefault. Or, if you are installing ADAM on a domain controller, click This account, and then select a domain user account to use as the ADAM service account. adam-sbs-09s

Note You can change the ADAM service account after ADAM is installed by using the Dsmgmt command-line tool. When you install ADAM on a domain controller, you must select a domain user account as the ADAM service account. 9. On the ADAM Administrators page, you select a user or group to become the default administrator for the ADAM instance. The user or group that you select will have full administrative control of the ADAM instance. By default, the Active Directory A pplication Mode Setup Wizard speci !es the currently logged on user. You can change this selection to any local or domain account or group on your network. For this exercise, click the default value of Currently logged on user , and then click Next.


-B24 , 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

10. On the Importing LDIF Files page, you can import into the ADAM schema two .ldf !les containinguser class object de !nitions. Importing these user class object de!nitions is optional. However, these object de !nitions are required later in this guide so, you should import these de !nitions now: a. Click Import the selected LDIF !les for this instance of ADAM . b. Click MS-InetOrgPerson.LDF, and then click Add. c. Click MS-User.LDF, and then click Add. d. Click MS-UserProxy.LDF, click Add, and then click Next.

11. The Ready to Install page gives you an opportunity to review your installation selections. After you click Next, the Active Directory Application Mode Setup Wizard begins copying !les and setting up ADAM on your computer.


-B24 % 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

12. When the Active Directory Application Mode Setup Wizard !nishes installing ADAM, it displays this message: "You have successfully completed the Active Directory Application Mode Setup Wizard." When the Completing the Active Directory Application Mode Setup Wizard page appears, click Finish to close the wizard. Note If the Active Directory Application Mode Setup Wizard does not complete successfully, an error message describing the reason for the failure appears on the Summary page. If an error occurs in the Active Directory Application Mode Setup Wizard before the Summary page, you can review the error message that appears. In addition, you can click Start, click Run, and type either of the following: %windir%\Debug\adamsetup.log %windir%\Debug\adamsetup_loader.log The Adamsetup.log and Adamsetup_loader.log !les contain information that can help you troubleshoot the cause of an ADAM setup failure.

Creating Admin user in ADAM server: After installing ADAM, create an admin user in the ADAM server. This user will be added to the administrator member and will be used in all ADAM transaction such as adding, deleting , searching users in A DAM. Click Start-> All Program ->ADAM->ADAM ADSI EDIT A new window will appear, connect to the newly created ADAM instance.

In the Connection Settings, Give a name for your Connection eg: T24R09 Server Name : localhost or IP address of the ADAM server Port: 389 (port mentioned during the installation) Distinguished Name: Partition Name mentioned during installation Click Ok to connect to the newly created ADAM instance.


-B24 K 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Select your root DN (partition) right click on it , click new -> object . Create an object CN=USERS of type "container" under your DN Under CN=USERS, create an object CN=DAS001 of type "user". Select your group CN=USERS, right click on the newly created user and click on reset Password Remember the password as it will be used to log into the ADAM server programmatically. Note: Don't mention CN=DAS001, mention your name alone like DAS001. The name can be anything. If you don't see object type user, then you have not loaded the inetOrgPwerson.ldf

!le during instance creation.

Now add this newly created user CN =DAS001,CN=USERS,O=Temenos,C=IN as a member of administrator. Explore your rootDN. click CN=Roles select CN=Administartors right click on it and choose properties.

In the listed properties, select member property and edit. New window will appear . Choose "Add ADAM Account" and add the newly created user (CN=DAS001,CN=USERS,O=Temenos,C=IN) in the text box and click OK. You can able to see the newly created user added as an administrator.


-B24 ' 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Admin user successfully created.

Admin user Test: Install Jxplorer in your system. JXplorer is a Java browser designed speci !cally to interact with the LDAP server. Install JXplorer.exe in your system .Go by default installation location. Start JXplorer by double click on the Jxplorer.bat (\JXplorer), you will get a screen similar to screen shot below.

Base DN: Partition Name User DN: CN=DAS001,CN=USERS,O=Temenos,C=IN Password: Mention all other parameters like Host, port information and click OK. You should successfully get connected to the ADAM instance

T24 Schema: For storing T24 user records in the ADAM ldap server, import the below ldf !le into your ADAM instance. For importing the ldf !le, click Start->All Program->ADAM->choose ADAM Tools Command Prompt. Copy the above ldf !le into C:\Windows\ADAM location. Type the command and import the ldf !le into your ADAM server instance.


-B24 * 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Note: If any problem faced during importing the ldf !le, get the latest version and try again. Now you can check in your ADAM instance whether you got the T24 attributes and objects. Go To Adam ADSI Edit, select the context, right click connect to. Mention the below parameters and check for the existence of T24 attributes and objects in ADAM server.

In addition to these attributes and objects, One attribute named uniqueMember and Object groupofUniqueNames need to be created. To create a new attribute, use mmc tool. mmc- Microsoft Management Console click Start -> select run ->type mmc in the text box click ok.

A new window will be opened with name console1.click File->click Add/Remove snap in


-B24 L 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Click "Add" button in Add/Remove Snap-in window. Select and add ADAM schema from Add Standalone Snap-in . Close the window after adding it. Click Ok in Add /Remove Snap-in window.

Now you will get your ADAM Schema in your Console Root. Connect to your ADAM server to create attribute and Objects. Select ADAM Schema, right click choose Change ADAM server.


-B24 "$ 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Enter your Server name (IP address) and port number of your ADAM server and click OK.

After connecting to your ADAM instance, explore the tree and have a look at the available objects and attributes. First you need to create attribute named uniqueMember. Select Attribute, right click and choose create.


-B24 "" 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Enter the below details for attribute "uniqueMember" in create New Attribute window. After entering the details click OK.

Create a Object "groupOfUniqueNames"

Enter the following details in "Create New Schema Class" and click next


-B24 "& 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Enter the attribute details, click Add button of Optional, select uniqueMember from the "select Schema Object" and click Ok. uniqueMember will be added as an attribute to the object. Similarly add attribute "o" to the object groupOfUniqueNames.

Click Finish to create object. Now check ADAM server for all the T24 objects and attributes. Now you can store T24 users in the ADAM server.

TCSERVER CONFIGURATION: Things need to be con !gured in TCServer for LDAP directory server 1.

CLASSPATH entry in .pro!le


-B24 "! 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

2.

Adding JAVA System Properties in .pro!le

3.

Con!guring TCServer jaas.con!g($HOME/tcserver/conf/jaas.con!g)

4.

Con!guring ldapMappingCon !guration.properties

!"#$%#&$"'( *+&, -.

($HOME/tcserver/conf/ ldapMappingCon!guration.properties) 5.

Con!guring EB.LDAP.PARAMETER application

6.

Creating Users in T24 server and ADAM server.

7.

Con!guring tcserver.xml ($HOME/tcserver/conf/TCServer/tcserver.xml)

T24 - CLASSPATH: Before adding class path entries to the T24 environment, ensure you got the below three jar $HOME/tcserver/lib directory. Then add CLASSPATH entry to point to the following jar 1.

tcsecurity.jar

2.

tcommon.jar

3.

log4j-1.2.9.jar

4.

bcprov-jdk14-133.jar

!les in

!les.

T24 - SYSTEM PROPERTIES: Next we need to add JAVA System Properties to the T24 environment. We can make use JBCJVMOPT to add these entries Add the below JBCJVMOPT ions to the .pro !le !le. JBCJVMOPT1=-Djava.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory JBCJVMOPT2=-Djava.naming.provider.url=ldap://:

T24 – JAAS.CONFIG jaas.con!g is a con!guration !le used by TCServer to get the LDAP server information. Change the impersonnate block alone in jaas.con !g to match your LDAP server. Ldap server ip address – you can g et the IP address and port number from slapd.bat for openldap server impersonnate { com.temenos.tocf.security.Authent.module.GounLoginModule required debug=true user.provider.url= "ldap://:/uid=devT24,ou=t24,ou=application,o=temenos,c=ch" ldap.security.credential.type="simple" ldap.server.url="ldap://< ldap server ip address >:/" user.provider.login="cn=TManager,c=ch" user.provider.password="secret" ; };

T24 - ldapMappingCon!guration.properties Location: /tcserver/conf/ldapMappingCon !guration.properties ldapMappingCon!guration.properties !le describes the Attributes, Objects, Classes used in LDAP server. This property

!les describes the schema used in the LDAP

directory server. These values are used by class !les of tcsecurity.jar !le. Map the value with your LDAP server attribute. The Values are case sensitive, make sure it is exactly the replica of the below content. # This !le contains mapping for LDAP Server in case # of the LDAP schema doesn't map the recommended Temenos one # Restriction T24User need to derived from top ldap object #Object ldapObjT24User=t24User ldapObjT24Dniop=dniop #Attribute ldapAttrT24UID= temenosT24UserId ldapAttrT24SON= temenosT24UserSignOnName ldapAttrT24PWD= temenosT24UserPassword ldapAttrT24SYSDN= temenosT24UserCorpDN


-B24 ", 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

ldapAttrT24Pro!leName=notUsed ldapAttrT24ExpirationDate=notUsed ldapAttrT24DepartmentCode=notUsed ldapAttrT24Company=temenosT24UserCompany

#Used to create new DN: needed because some directory server doesn't used attribute name but always CN???? ldapIndexT24UID=t24userid ldapIndexT24Organisation=cn

#Standard Ldap Object ldapAttrOrganistion=o ldapAttrUniqueMember=uniquemember ldapAttrCN=cn ldapAttrDN=dn ldapAttrUserPWD=userPassword ldapAttrUserUID=uid ldapAttrUserPKCS12=usercerti!cate;binary #Con!gure the caching usage ldapGounCreation=true ldapADAM=true

EB.LDAP.PARAMETER: Create two records in EB.LDAP.PARAMETER application SYSTEM and T24. T24 users will be created in the LDAP server based on the value of root DN in SYSTEM record.

Screen shot of SYSTEM record is shown. T24 user will be created in the O=Microsoft,C=US branch . Created T24 user in LDAP server should have entry with USER id and an additional node named dniop. Additional entry dniop should have a property named "uniqueMember" with value uniqueMember = , LDAP.DN – value mentioned while creating user. rootDN – value of corporate branch mentioned in the root DN


!eld of

T24 record in EB.LDAP.PARAMETER application.

-B24 "% 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

EB.LDAP.PARAMETER T24 record represents corporate branch. Root DN value should point your corporate branch. Note: Values of HostName, Port, Root.DN , USER.DN ,PASSWORD should map to your LDAP set up. Reference: Kindly refer the guide "TC14-install-Security-Service-guide" to create EB.API records for Active Directory.

Creating T24 users in LDAP: Create T24 user with user id VINOD04

While creating user, mention LDAP.ID to be T24 and LDAP.DN value to be CN=VINOD3 CN=VINOD3 represents corporate user. Commit and authorise the record. Check whether you got the user created in LDAP server.


-B24 "K 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Set the password for the corporate user CN=VINOD03 by right click on the user, choose option Reset Password and enter the new password Ensure you got the value for all the attributes mentioned in the ldapMappingCon !guration.properties for the T24 user created in ldap server. ldapAttrT24UID= temenosT24UserId ldapAttrT24SON= temenosT24UserSignOnName ldapAttrT24PWD= temenosT24UserPassword ldapAttrT24SYSDN= temenosT24UserCorpDN In dniop entry ldapAttrUniqueMember=uniquemember

T24 – tcserver.xml: After creating users, con !gure the tcserver.xml to use impersonation. Finally tcserver.xml needs to be con !gured if LDAP directory server is used. For this, we need to create an ADAPTER, and a LISTENER. In tcserver.xml 1. you need to add a new tag in the global part of 2. Create a new APAPTER and LISTENER. . . . . 5 0

30

impersonnate

/glodev/Pareas/karupiah/TestBase/TestBase.run

/glosoft/TAFC_R09_GA path to your tss OFS SOURCE

. . " type="tcp" active="true"> T24

TCCLIENT CONFIGURATION: Things need to be con !gured in TCClient for LDAP d irectory server 1.

Con!guring TCClient jaas.con !g(/webapps/BrowserWeb/WEB-INF/conf/jaas.con!g)

2.

Con!guring channels.xml

(WEBSERVERHOME/webapps/BrowserWeb/WEB-INF/conf/channels.xml)

TCC – JAAS.CONFIG: jaas.con!g is a con!guration !le used by TCClient to communicate with the LDAP server information. Change the information in jaas.con !g to match your LDAP server. login { com.temenos.tocf.security.Authent.module.TClientLDAPLoginModule required debug="true"


-B24 "' 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

ldap.security.credential.type = "simple" user.provider.url="ldap:///" user.provider.login="cn=TManager,c=ch" user.provider.password="secret" ldap.server.url="ldap:///" ; };

TCC – CHANNELS.XML: Channels.xml will be used by TCClient to communicate with T24 server on external user login. Add SECURITY_CONFIG tag to the root CHANNELS tag. Add LOGIN_CONTEXT tag with "login" as the value . Web server will use this SECURITY_CONFIG and LOGIN_CONTEXT value to identify to locate jaas.con !g . WEBSERVERHOME\webapps\BrowserWeb\WEB-INF\conf\jaas.con!g

browser.1

login

120

tcp

5

30

. . .

Con!guring Authentication in Tomcat and JBOSS server: The purpose of the JNDIRealm implementation is to provide a mechanism by which web servers can acquire information needed to authenticate web application users, and de!ne their security roles, from a directory server or other service accessed via JNDI APIs. JNDIRealm con!guration should be done in server.xml. Con !gure the realm de!nition inside the engine root tag. Comment the other realm con !guration de !nition in your server.xml !le. JNDIRealm con!guration will go in hand with BASIC or FORM authentication, to authenticate the users against the directory servers con

!gured using the Realm de !nition.

JNDIRealm is an implementation of the Tomcat 6 Realm interface that looks up users in an LDAP directory server accessed by a JNDI provider (typically, the standard LDAP provider that is available with the JNDI API classes). connectionURL = Directory Server name or IP address connectionName = Admin user of the LDAP server conectionPassword = Password of the admin user


-B24 "* 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

userBase = The base element for user searches performed using the userSearch expression userSearch = The LDAP !lter expression to use when searching for a user in the directory.{0} is the placeholder will be replaced by the username typed in the FORM or BASIC authentication screens. userRoleName=Access to T24 Browser is restricted to users(Corporate Branch) belong to the department "t24user". Note: userRoleName="department" department property can be changed to any valid attribute. In our case we don't have "role" attribute for corporate entries, so we have used an arbitrary attribute "department". Refer the below hyperlink for complete con !guration of JNDI Realm http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JNDIRealm (http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JNDIRealm) The below con!guration will authenticate the users against their corporate branch.

TOMCAT 6.0: Con!gure the server.xml with this realm de !nition in this location of your /conf/server.xml Tomcat
connectionURL="ldap://10.92.3.59:389"

connectionName="CN=DAS001,CN=USERS,O=Temenos,C=IN"

connectionPassword="example"

userBase="O=Temenos,C=IN"

userSearch="(cn={0})"

userRoleName="department" />

JBOSS: The same can be done in JBOSS server in this location \server\default\deploy\jboss-web.deployer\server.xml
connectionURL="ldap://10.92.3.59:389"

connectionName="CN=DAS001,CN=USERS,O=Temenos,C=IN"

connectionPassword="example"

userBase="O=Temenos,C=IN"

userSearch="(cn={0})"

userRoleName="department" />

In addition to this con !guration, con !gure login-con !g.xml !le in the location \server\default\conf\login-con!g.xml

ldap://10.92.3.59:389/O=Temenos,C=IN simple CN=DAS001,CN=USERS,O=Temenos,C=IN example ldap://10.92.3.59:389/

Linking corporate users and T24 users: Corporate users and T24 users resides in two di # erent branches.


-B24 "L 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

User access T24 Browser, will enter the corporate credentials in the login screen. When creating T24 users using USER application, mention the LDAP.DN information to be corporate user DN. Example: Corporate user: CN=Administrator, CN=ASIA,CN=temenosgroup,CN=COM While creating a T24 user for this administrator, mention the LDAP.DN to be CN=Administrator.

External Identity Role De!nition: Before creating T24 user in the LDAP, create external identity users in the corporate branch. Select your corporate branch, create a user. After creating, right click on the created user, select properties.

Set a password for your newly created user. You will be entering this Password when you log into the T24 Browser. Edit the property department and mention the value to be "t24user" If the external identity user doesn't have the value "t24user", T24 access will be denied. "t24user" is the user's role restricted in accessing the T24 Browser. This value is con !gurable. When changing the value, change the value in tag of and tag of web.xml.

t24user

t24user


-B24 &$ 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Note: Here we have used "department" property since ADAM does not have "role" property for users.

Con!guring Browser Web: Con!gure the T24 Browser Web application to enable Single sign On with Active directory. BASIC or FORM authentication can be enabled for single sign on with active Directory. BASIC Authentication: Remove the comments from the web.xml of BrowserWeb
t24user

BrowserWeb

/*

t24user

BASIC T24 Browser

--> FORM Authentication: Remove the comments from the web.xml of BrowserWeb
t24user

BrowserWeb

/servlet/BrowserServlet

t24user

FORM

/jsps/formLogin.jsp

/jsps/formError.jsp


-B24 &" 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

--> Remove the comment on the error page tag. This change is common for b oth BASIC and FORM authentication. com.temenos.t24browser.exceptions.GenericAuthenticationException /jsps/customMessage.jsp --> Request will be intercepted by the

!lter

GenericWebAuthenitcationFilter.java, uncomment the

!lter and !lter-mapping de!nition of

GenericWebAuthenitcationFilter.java

GenericWebAuthenticationFilter This !lter retrieves the creates the SSOPrincipal object com.temenos.t24browser.security.GenericWebAuthenticationFilter GenericWebAuthenticationFilter /servlet/* /jsps/* --> With the changes, the T24 Browser request will be intercepted by the

!lter and single sign on will be enabled.

ldap.con!g is a property !le located in BrowserWeb/ WEB-INF/conf folder used by the !lter to create the DN. CN=, will be replaced by username Mention the location of ldap.con !g !le in the system property. Property Name: ARC_CONFIG_PATH Property Value: /webapps/BrowserWeb/WEB-INF/conf/ldap.con!g

Single Sign on using BASIC Authentication: We need to login to T24 using T24 Browser with single sign on mechanism. Con!gure the web.xml based on the instruction above. Type the url in the address bar of any browser, new login screen will pop up


-B24 && 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

!"#$%#&$"'( *+&, -.

Enter the corporate credentials for the user VINOD3 and click OK.

Since its !rst time login, you need to change the T24 password. Change the password and click the go button. You will be directed to the home page of T24 b rowser.

Single sign on with FORM authentication: Similarly con !gure the web.xml to enable FORM based authentication. Type the url to access T24 Browser.

New FORM login page will be displayed, enter the corporate credentials click sign in button. you will logged into the T24. If the credentials are wrong error page will displayed.


-B24 &! 5C &,

/01234 /021 51 6078 ./ 9:70;4 <0=4:75=>?@A/

COPYRIGHT © 2016 TEMENOS HEADQUARTERS SA Best viewed in Internet Explorer 10 & above


!"#$%#&$"'( *+&, -.

(http://www.temeno

-B24 &, 5C &,

Single Sign on With MS Active Directory-TCS

Recommend Documents