Configuring the Single Sign On (SSO)

Before you start the procedure, check the following requirements:

  • All servers with Windows Server 2019 or 2022 environment are connected in a domain;
  • Domain Controller with AD user group is configured on Windows Server.

To configure and use the Single Sign On (SSO) with Fudo Enterprise, please follow below steps.

Note

Please note that this is a general guide, and specific details may vary depending on your Windows Server setup. Refer to the Windows Server documentation for precise configuration steps.

SSO configuration on Windows Server 2019

Add User:

  1. Log in to the server on which you want to setup the SSO using the administrator account.
  2. Open the Server Manager application.
  3. Click Tools button on the upper right corner of the window to expand the menu list and select Active Directory Users and Computers.
../../_images/sso_win_add_user_1.png
  1. In the Manager window, navigate to the domain name, or a specific user group, and right-click on the Users catalog.
  2. Select New > User.
  3. Create a user who will use SSO to log in to Fudo Enterprise (e.g., User logon name: ad-user1).
../../_images/sso_win_add_user_2.png
  1. Click Next.
  2. Provide the password for created user (e.g., PaSSwOrD) and select Password never expires option.
  3. Click Next and Finish.
../../_images/sso_win_add_user_3.png

Configure DNS entries:

  1. Open the Server Manager application.
  2. Click Tools button on the upper right corner of the window to expand the menu list and select DNS.
../../_images/sso_win_dns.png
  1. Go to Forward Lookup Zones, right click on the domain name and select New Host.
  2. Provide the Name and IP address of the Fudo Enterprise Admin Panel (e.g., mgmt241.qa.sso, 10.0.32.241).
  3. Click Add Host.
../../_images/sso_win_forward_zone.png
  1. Right click on Reverse Lookup Zone and select New Zone.
  2. Click Next.
  3. Select Primary zone option and click Next.
  4. Select To all DNS servers running on domain controllers in this domain: option and click Next.
  5. Select IPV4 Reverse Lookup Zone option and click Next.
  6. In the Network ID field, type in the start of the subnet range of your network (e.g., 10.0.32) and click Next.
../../_images/sso_win_reverse_zone_1.png
  1. Choose the dynamic update option (e.g., Allow only secure dynamic updates) and click Next.
  2. Click Finish.
  3. Right click on created zone 32.0.10.in-addr.arpa and select New Pointer (PTR).
  4. Provide the Host IP Address and Host name of the Admin Panel (e.g., 10.0.32.241 and mgmt241.qa.sso).
../../_images/sso_win_reverse_zone_2.png

Create Kerberos ticket:

  1. Run the following command in the Powershell or CMD console:

    ktpass -princ HTTP/hostname.yourdomain.local@yourdomain.local -mapuser netbios_domain_name\username -pass password -ptype KRB5_NT_PRINCIPAL -out hostname.yourdomain.local.keytab

    • Example for this use case:

    ktpass -princ HTTP/mgmt241.qa.sso@QA.SSO -mapuser QA\ad-user1 -pass PaSSwOrD -ptype KRB5_NT_PRINCIPAL -out mgmt241.qa.sso.keytab

  2. Copy the generated keytab file to the workstation where you will be configuring Fudo.

Setup Fudo Enterprise

Note

This use case describes how to configure Fudo Enterprise using the Active Directory external authentication method. Please keep in mind that you can customize user authentication using other method supported by Fudo Enterprise to align with your specific requirements, the methods typically used in your environment, and your work scenarios.

Configure SSO:

In order to define SSO service parameters in Fudo Enterprise, follow the steps:

  1. Login into your Fudo Enterprise Admin Panel using the credentials for user with superadmin role.
  1. Select Settings > System.
  1. In the Timezone section, check if the selected timezone is consistent with the Windows client timezone configuration.

Warning

Fudo Enterprise Timezone must match the Windows client timezone configuration.

../../_images/sso_fudo_timezone.png
  1. Select Settings > Authentication.
  2. Go to Global tab.
  3. In the SSO section, click the Upload button next to the Management SSO settings field.
../../_images/sso_fudo_sso_settings_mgmt.png
  1. In the Principal name field, provide service identifier that will match the user account with the service instance (e.g., HTTP/mgmt241.qa.sso@QA.SSO).
  2. In the Keytab field, upload the keytab file containing user’s ID and encryption keys for encrypting and decrypting Kerberos tickets (generated in previous steps mgmt241.qa.sso.keytab file).
../../_images/sso_fudo_sso_settings_mgmt_upload.png
  1. Click Save.

Note

You can also configure SSO for the User Access Gateway by uploading the appropriately configured keytab file in the User Access SSO settings field. Remember to use the Access Gateway IP address when configuring the Windows environment.

Configure DNS:

  1. Go to Settings > Network configuration.
  2. Switch to the Name & DNS tab.

  1. Enter hostname.yourdomain.local in the Hostname field (e.g., mgmt241.qa.sso).

  2. Configure DNS server to point to a DNS server in the yourdomain.local domain (in this example we will use a domain controller IP address):

    • Click Add DNS server to define new DNS server.
    • Enter DNS server IP address (e.g., 10.0.242.100).
    • Click Save.

Configure external authentication method:

  1. Login into your Fudo Enterprise Admin Panel.
  1. Select Settings > Authentication.
  2. In the External authentication tab click Add an external authentication.
  1. In the Name field, provide a name for this configuration.
  2. Set the Bind address to Any.
  3. In the General field select Active Directory.
  4. In the Host field provide the Domain Controller IP address (e.g., 10.0.242.100).
  5. Leave default port number: 389.
  6. Provide the name of the domain which will be used for authenticating users in Active Directory (e.g., qa.sso).
  7. In the Login and Secret fields provide the privileged account’s login credentials used to access the Domain Controller.
  1. Click Save.

Create User in Fudo:

Warning

Single Sign On setup is available only for users with the superadmin role, and can be used by users with the operator, admin, and superadmin roles.

  1. Select Management > Users and then click Add user.
  1. Enter the user name that matches created in previous steps user account in Active Directory (e.g., ad-user1).
  2. Select the Admin role.
  3. In the Settings tab, under the Safes section, select main to grant access rights to the Admin Panel.
  1. Click Save.
  1. Go to the Authentication section and from the Add authentication method drop down list select External authentication.
  1. Chose created in previous steps Active Directory method and click Save.
  1. In the User Data tab, fill in the Fudo domain and AD domain (e.g., qa.sso).

Note

Both the Fudo domain and AD domain should match the domain name specified in the Kerberos ticket.

  1. If necessary, please fill in the remaining parameters as needed for your specific configuration. For more details, please refer to the Creating a user section.
  1. Click Save and close.

Setup and check user workstation - Windows2010 Client

Firefox browser configuration:

  1. Log in to Windows Client using the ad-user1 account.
  2. Open Firefox, type about:config in the address bar, and press Enter.
  3. A warning message will appear. Click on Accept the Risk and Continue option to proceed.
  4. In the search bar at the top, type network.negotiate-auth.trusted-uris.
  5. Double-click on the network.negotiate-auth.trusted-uris and enter the desired FQDN (Fully Qualified Domain Name) with a protocol, separating entries with a comma (e.g., https://mgmt241.qa.sso,https://uag242.qa.sso).
  6. Press Enter to save the changes.
../../_images/sso_ff_conf.png
  1. Next, type in network.automatic-ntlm-auth.trusted-uris in the search bar.
  2. Double-click on the network.automatic-ntlm-auth.trusted-uris and enter the desired FQDN (Fully Qualified Domain Name) with a protocol, separating entries with a comma (e.g., https://mgmt241.qa.sso,https://uag242.qa.sso).
  3. Press Enter to save the changes.
  4. Restart the browser.

Internet Explorer browser configuration:

  1. Navigate to Tools > Internet Options > Advanced.
  2. On the Advanced tab and in the Security section, select Enable Integrated Windows Authentication.
../../_images/sso_ie_conf_1.png
  1. On the Security tab, select Local Intranet.
  2. Click Custom Level.
  3. In the User Authentication/Logon section, select Automatic logon only in Intranet zone.
../../_images/sso_ie_conf_2.png
  1. Click OK.
  2. Click Sites and select all check boxes.
  3. Click Advanced and add Remedy SSO service website to the local zone (in our example, it’s https://mgmt241.qa.sso).
  4. Click Add.
  5. Click OK for all pop-ups.
  6. Uruchom ponownie przeglądarkę.

Chrome browser configuration:

Google Chrome supports Kerberos authentication. Once Internet Explorer is configured, no additional settings are needed for Google Chrome, as it relies on Internet Explorer’s configuration.

Log into the Admin Panel using SSO:

  1. Open the Firefox browser and enter the previously defined FQDN in the address bar ( in our example, it’s https://mgmt241.qa.sso).
  2. The Fudo Enterprise Admin Panel Dashboard will appear without the need to use login credentials.
../../_images/sso_fudo_admin_log.png

Related topics: