Configuring Lite Web Portal for single sign-on after installation

After you install the Remote Control Server, you can configure the Lite Web Portal to support SAML 2.0 authentication.

About this task

You must create a keystore with a single self-signed certificate (or CA signed certificate) before you start the configuration.

Note:

If Single Sign-on (SSO) is enabled then the Basic authentication will be disabled for security reasons, in other words login using user-name and password will be denied.

Select a Key Size of 2048 and select sha256 for the Signature Algorithm. The keystore file must be a .p12 file. Do not save the file to the server installation directory because that might conflict with the server self-signed certificate. Set a long validity period for the keystore. For more information about creating a keystore file, see Creating a self signed certificate.

Note:

SSO support in Remote Control is done through the WebSphere Liberty samlWebSso20 feature. By default, the NameID that is returned by the Identity Provider to our service must contain an email field in the following format.

URI: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

You can configure a Liberty server as a SAML web browser Single-Sign-On (SSO) service provider by enabling the samlWeb-2.0 feature in Liberty.

To configure the Remote Control server to enable the SSO into the Lite Web Portal, complete the following steps:

Procedure

Create a lwp_sso.xml file in the following directory: [server_installation]\BigFix\TRC\server\wlp\usr\servers\trcserver.

Add the following content to the lwp_sso.xml file:

<server> 
	<featureManager>
		<feature>samlWeb-2.0</feature>
	</featureManager>
	<keyStore id="lwpSamlKeyStore" location="[samlKey.file]" password="[yourkeystorepassword]" type="PKCS12"/>
	<samlWebSso20 authFilterRef="lwpAuthFilter" httpsRequired="true" id="lwpSP" idpMetadata="[idpMetadata.file]" keyStoreRef="lwpSamlKeyStore" signatureMethodAlgorithm="SHA256" spHostAndPort="[hostname:port]">
	</samlWebSso20>
	<authFilter id="lwpAuthFilter">
		<requestUrl id="myUrlFilter" matchType="contains" urlPattern="/ondemand"/>
		<requestUrl id="excludeApi" urlPattern="/api/" matchType="notContain" />
	</authFilter>
	<httpSession InvalidateOnUnauthorizedSessionRequestException="true" />
</server>

[hostname:port]: Defines the host name and SSL port of your Lite Web Portal. For example, https://example.com:443/.
[samlKey.file]: Defines the path to your keystore file. For example, c:\trc\samlKey.jks.
[idpMetadata.file]: Defines the path to the metadata file received by the Identity Provider.
[yourkeystorepassword]: Defines the password for your keystore file. For example, password="mypassword".

Edit the application.xml file in the following directory by adding this snippet: [server_installation]\BigFix\TRC\server\wlp\usr\servers\trcserver.

<server> 
 <application 	context-root="/trc" type="ear" id="trcserver" location="TRCAPP.ear" 
 	name="trcserver"  autoStart="true" > 
	<application-bnd>  
         <security-role name="any-authenticated">  
         <special-subject type="ALL_AUTHENTICATED_USERS"/>  
         </security-role>  
 </application-bnd>
</application> 
 <application 	context-root="/" type="ear" id="trcredir" location="REDIR.ear" 
 	name="trcredir"  autoStart="true" /> 
<applicationMonitor updateTrigger="disabled" dropinsEnabled="false" /> 
<config updateTrigger="disabled" /> 
</server>

Edit the cookie.xml file in the following directory by adding this snippet: [server_installation]\BigFix\TRC\server\wlp\usr\servers\trcserver.
```
<server> 
<httpSession cookieSecure="true" /> 
</server>
```
Get the SAML metadata XML file from the Identity Provider (IdP). How this file is obtained varies, depending on the IdP. Rename the file to lwpIdpMetadata.xml and copy it to the following directory on the server: [server_installation]\BigFix\TRC\server\wlp\usr\servers\trcserver \resources\security.
Edit the ondemand.properties file and set:
- liteweb.portal.url = [hostname:port]
- liteweb.portal.sso.enabled=true
[hostname:port]

Defines the host name and SSL port of your Lite Web Portal. For example, https://example.com:443/.

The file is in the following directory: [server_installation]\wlp\usr\servers\trcserver\apps\TRCAPP.ear\trc.war\WEB-INF \classes

Add the following line into the file [server_installation]\BigFix\TRC\server\wlp\usr\servers\trcserver\server.xml:

<server description="Bigfix Remote Control">
<!-- THIS FILE IS AUTO GENERATED -->
<!-- Use this file userpre.xml to include custom configuration -->
<!-- or userpost.xml -->
<include optional="true" location="userpre.xml" />
<include optional="true" location="../../../../tools/env/env.xml" />

    <!-- Enable features -->
    <featureManager>
        <feature>jsp-2.3</feature>
        <feature>jdbc-4.2</feature>
        <feature>servlet-4.0</feature>
        <feature>transportSecurity-1.0</feature>
        <feature>jsf-2.3</feature>
    	<feature>javaMail-1.6</feature>
	<feature>jsonp-1.1</feature>
        <feature>jaxb-2.2</feature>
	<feature>jndi-1.0</feature>
    </featureManager>
    
<include optional="true" location="sso.xml" />
    
<include location="application.xml" />

<include location="memory.xml" />

<include location="host.xml" />

<include optional="true" location="cookie.xml" />

<include location="database.xml" />

<include location="ssl.xml" />

<include optional="true" location="userpost.xml" />

<include optional="true" location="lwp_sso.xml" />

</server>

Restart the Remote Control server.
After the server restarts, type the following URL into your browser to download the metadata for this service provider (SP) which is the BigFix® Remote Control Server: https://[hostname:port]/ibm/saml20/lwpSP/samlmetadata, where [hostname] is the host name of your Remote Control server and [port] is the SSL port of the server. Provide the metadata to the SAML identity provider to establish federation between this SP and Identity Provider (IdP). When you access the Remote Control server application, and you did not previously log on, you are redirected to the IdP. If you did previously log on by using the same IdP, you are automatically logged on to the Remote Control Lite Web Portal.

Note:
After you enable SAML 2.0 authentication, if you reinstall or upgrade your server, the lwp_sso.xml file must be copied to a temporary directory before you start. Replace the lwp_sso.xml file that is installed during the upgrade with the backed-up file. Also, ensure that liteweb.portal.sso.enabled is set to True and liteweb.portal.url = [hostname:port] where [hostname] is the hostname of the Lite Web Portal and [port] is the port in the ondemand.properties file.