Configuring Single Sign On (SSO) from NetIQ Access Manager and LiveTime ITSM
LiveTime Service Manager is a complete IT service management solution that can be used for 11 ITIL processes from Service Request Management through to Change and Release Management. It provides various end-user roles (customers, Supervisors, Technician, Partner, etc) who can access the web based portal & manage service requests.
LiveTime Service Manager includes support for SAML based Single Sign-On (SSO). With this addition of SAML support LiveTime can streamline end user’s experience without forcing the user to re-authenticate at application. Access Manager is a product which facilitates secure access to LiveTime & can leverage the SAML based SSO support in Service Manager to provide seamless experience to end users.
Service Manager allows SSO from Open Source solutions such as Shibboleth, JOSSO, OpenSSO etc as well as commercial vendors like NetIQ Access Manager, CA Siteminder, Oracle Identity Manager etc. In this article we will focus on configuration for SAML based SSO from NetIQ Access Manager to LiveTime Service Manager.
Glossary of Terms
SSO – Single Sign On
NAM – NetIQ Access Manager
NAM-IDP – NAM Identity Provider
NAM-AG – NAM Access Gateway
Understanding SSO Configuration
Service Manager manages HTTP session headers from the provider (web access gateway) to enable seamless access for user to application. The Login session is managed by Identity Provider (IdP) and the access to resource is managed by Service Provider (SP). This session information & associated user data is then filtered down to the protected application which uses the given data for granting access to user & bypass authentication.
For the above scenario in this document, Identity Provider is NAM-IDP, Service Provider is NAM-AG & the protected application is LiveTime Service Manager. Configuration for SSO in LiveTime is located at (Setup > Authentication > SSO) as shown in Figure-1. There are three configurations to enable SSO, all of which are mandatory (as explained in following table):
|Session ID||This is the name of HTTP header passed to NSD which contains Session ID for the logged in user.|
|Username||Name of the HTTP header which contain login name of the user attempting to access NSD|
|Name of the HTTP header which contain email of the user attempting to access NSD. This email value is used to validate the username.|
Preparations for Configuration
This document specifically focuses on SAML based SSO related configuration, so it is assumed that other parts of setup are already available & few key configurations are already done before we proceed. These are few per-requisites before we proceed with further configuration:
- LiveTime Service Manager is installed & configured with appropriate user store.
- NetIQ Access Manager is installed & configured with appropriate user store.
- Both LiveTime & NAM share the same user store OR the user credentials/data is synced among the both user stores.
- Basic reverse proxy service is configured on NAM for LiveTime (LiveTIme is added as path based OR domain based protected resource).
Configuring NAM for SAML based SSO
As discussed above it is assumed that LiveTime has been configured as protected resource (path based OR domain based). The next step is to configure an Identity Injection policy which injects appropriate headers into the HTTP requests to LiveTime as required for SAML based SSO. Following are the steps to configure the Identity Injection policy for LiveTime.
Steps to Configure Identity Injection Policy for LiveTime
- Go to iManager (Access Manager > Policies) & add a new Policy of type – “Access Gateway: Identity Injection”
- On the “Edit Rule” page provide description for your policy (Optional)
- Create “New” action & select – “Inject Into Custom Header”. In the details select value as “Credential Profile”, then select “SAML Credentials” > “SAML Assertion” (as shown in Figure-2).
- Create “New” action & select – “Inject Into Custom Header”. In the details select value as “Credential Profile”, then select “LDAP Credentials” > “LDAP User Name” (as shown in Figure-3).
- Create “New” action & select – “Inject Into Custom Header”. In the details select value as “LDAP Attribute”, then select “mail” (as shown in Figure-4).
- Once all the above configuration are done the identity injection policy will look as shown in Figure-5.
- Enable this Identity Injection policy for the protected resource configured for LiveTime.
Configuring LiveTime for SSO
Once we are done with NAM configuration now the setup is ready for enabling LiveTime configuration. It is recommended (not mandatory) that Identity Injection to LiveTime is already enabled & the administrator can verify the HTTP headers received by LiveTime while configuring SSO.
Following are steps to configure SSO on LiveTime:
- Login to LiveTime as Administrator & open SSO configuration at (Setup > Authentication > SSO)
- Edit the configuration & Select “On” for ‘Active’ field.
- If you have login to LiveTime through NAM with Identity Injection policy enabled – Click on the icon to review HTTP headers passed through Access Gateway (NAM).
- Configure HTTP header name for SAML Assertion as ‘Session ID’ (e.g. ‘samlsession’ as shown in Figure-5)
- Configure HTTP header name for current logged in user as ‘Username’ (e.g. ‘username’ as shown in Figure-5)
- Configure HTTP header name for user email as ‘Email’ (e.g. ‘useremail’ as shown in Figure-5)
- Once all the above configuration are done the identity injection policy will look as shown in Figure-6.
- Save the configuration & validate SSO through NAM.
Configuration for Simultaneous Logout
In this scenario ‘Simultaneous Logout’ is the ability to logoff from NAM session whenever user clicks Logout on LiveTime portal. LiveTime Service Manager does not have specific configuration to enable Simultaneous Logout with web access gateways (for example this configuration is available for applications like GroupWise, Vibe etc). So in order to enable simultaneous logout for LiveTime one must configure Form Fill policy as follows.
- Create a new FormFill policy for LiveTime simultaneous logout.
- On the “Edit Policy” page provide description for your policy (Optional)
- Create ‘New’ action & select – Form Login Failure
- In “Page Matching Criteria” field configure following text from LiveTime logout page – “Your session has ended. Please use the button below to login again.”
- In “Redirect to URL” field configure the Logout URL for your setup e.g. https://mynam.com/AGLogout
- Once all the above configuration are done the Form Fill policy will look as shown in Figure-7.
- Enable this Form Fill policy for the protected resource configured for LiveTime.
This article demonstrates that it is possible to leverage SAML based SSO support on LiveTime Service Manager to allow SSO configuration using NetIQ Access Manager.