IBM Support

Configuring single sign-on for IBM Content Manager Services for Lotus Quickr

Release Notes


Abstract

This document describes the necessary steps to configure single sign-on (SSO) between IBM Content Manager Services for Lotus Quickr and Lotus Quickr 8.5 for WebSphere Portal by using LDAP.

Content

To configure single sign-on:

  1. Enable single sign-on in Content Manager EE library server.
  2. Configure single sign-on for IBM Content Manager Services for Lotus Quickr.
  3. Configure Lotus Quickr 8.5 for WebSphere Portal for SSO by using LDAP.

Enabling single sign-on (SSO) in the Content Manager EE library server

Before proceeding with this step, you must install Content Manager EE, LDAP, and IBM Content Manager Services for Lotus Quickr. The following procedure is explained by using a common LDAP which is shared across all the components in the stack, Content Manager EE, IBM Content Manager Services for Lotus Quickr, and Lotus Quickr 8.5 for WebSphere Portal.

Important: The minimum version required for LDAP is Content Manager EE Version 8.4.3.1 or later.


To enable single sign-on in Content Manager EE library server:

  1. Clear password is required for all users and enable AllowTrustedLogon
    1. Start the Content Manager EE system administration client .
    2. Select Tools > Manage Database Connection ID > Change Database Shared Connection ID from the Administration Client menu.
    3. Clear the Password is required for all users logging on to CM check box. Click OK to save the change.
    4. In the navigation pane, click Library server parameters > Configurations.
    5. Right-click Library Server Configuration in the right pane and select Properties.
    6. Set Max user action to Allow logon without warning and select the Allow trusted logon check box.
    7. Click OK to save the changes.
  2. Setup LDAP user import information
    1. Log in to Content Manager EE system administration client.
    2. Click Tools > LDAP Configuration.
    3. Go to the LDAP tab and select Enable LDAP User import and authentication check box.
    4. To configure the LDAP properties click on the Server panel and enter your LDAP server information.
    • Tip: In WebSphere Administration Console, the values for LDAP user registry settings must be configured correctly to filter the existing users in LDAP to log in to IBM Content Manager Services for Lotus Quickr.
    • Example: In WebSphere Administration Console, Secure administration, applications, and infrastructure > Standalone LDAP registry > Advanced Lightweight Directory Access Protocol(LDAP) user registry setting, if you are using sAMAccountName in your organization as the User ID value, the User filter setting should set to(&(sAMAccountName=%v)(objectcategory=user)) and User ID map should be user:sAMAccountName.
  3. Create privilege set for SSO users
    1. Log in to the Content Manager EE system administration client
    2. Expand Authorization.
    3. Click Privilege Sets.
    4. Select AllPrivs privilege set. This privilege set is used as an example. Modify the privilege set information as required.
    5. Right-click and select Copy > Advanced. Enter a name for this privilege set. Example: SSOPriv.
    6. For the newly created priviledge set (created in Step f.), select AllowTrustedLogon and clear the SystemSuperDomainAdmin check box. This privilege is not required.
    7. Click OK.
    Important: Do not clear the SystemSuperDomainAdmin check box from the AllPrivs privilege set in Step d.

4. Add LDAP users in Content Manager EE
    1. Log in to the Content Manager EE system administration client
    2. Expand Authentication.
    3. Right-click and select Users > New.
    4. Set Password expiration to Never expires.
    5. Click LDAP button and provide the user name you want to import.
    6. After the names are returned, highlight the name and click OK.
    7. Set Maximum privilege set to SSOPriv, the privilege set that you created in Step3.
    8. In the Set Default panel, enter Default item access control list and click OK to create new SSO user.
    9. Restart the Content Manager EE server.
5. Install the LDAP client to enable LDAP users to log in
Note: If the LDAP server is a IBM Tivoli Directory Server (ITDS), install the ITDS client on the same machine as the Content Manager EE.
    1. During the LDAP client installation, select the Java client and C client only.
    2. Add the file path C:\IBM\LDAP\V6.1\bin;C:\IBM\LDAP\V6.1\lib; to the environment variable PATH.
    3. Copy the DLL file from C:\Program Files\IBM\db2cmv8\ldap to C:\Program Files\IBM\db2cmv8\cmgmt\ls\icmnlsdb.
    4. Restart your server..
6. Verification of the LDAP setup with Content Manager EE
    1. Install the Content Manager EE Client for Windows.
    2. Verify whether the LDAP user can log in to Content Manager EE by using the client.


Configuring SSO for IBM Content Manager Services for Lotus Quickr

    To configure SSO for IBM Content Manager Services for Lotus Quickr:
    1. Set up LDAP for IBM Content Manager Services for Lotus Quickr
      1. Logon to WebSphere Administration client that you deployed IBM Content Manager Services for Lotus Quickr on.
      2. Click Application > Enterprise Applications > clb.cm.websvc > Security role to user/group mapping.
      3. Ensure that Everyone check box is clear. Select All authenticated check box and click OK.
      4. Click Security > Secure administration, applications, and infrastructure.
      5. Check Enable administrative security.
      6. Check Enable application security.
      7. Clear Java 2 security check box.
      8. Set the Available realm definitions to Standalone LDAP registry.
      9. Click Configure and set up the LDAP information and make sure you enter the same information that you entered when you created LDAP user information in Content Manager EE system administration client. See Set up LDAP user import information.
      10. Select the Reuse connection check box.
      11. Select the Ignore case for authorization check box.
      12. Clear the SSL enabled check box.
      13. Click Test connection and make sure you can successfully connect to the LDAP server.
      14. Click Apply and Save the changes to the master configuration.
      15. Restart the WebSphere Application server for the changes to take effect.
    Configuring SSO for Lotus Quickr 8.5 for WebSphere Portal

      To configure Lotus Quickr 8.5 for WebSphere Portal for SSO, see Lotus Quickr 8.5 for WebSphere Portal product documentation.

      To complete the SSO configuration between Lotus Quickr 8.5 for WebSphere Portal and IBM Content Manager Services for Lotus Quickr, you must synchronize the LTPA tokens between the two servers.

      To synchronize the LTPA tokens:
      1. On the Lotus Quickr 8.5 for WebSphere Portal server, open the WebSphere administration console.
      2. Expand Security > Secure administration ,applications and infrastructure.
      3. Click Authentication mechanisms and expiration.
      4. In the Single sign-on section, create a password and write it down.
      5. Type the full path to a file on the application server where you want to store the keys, such as /home/wasadmin/ltpa.keys.
      6. Click Export keys. WebSphere exports the LTPA keys into the location you specified.
      7. Click Apply and save the changes.
      8. Copy the LTPA key file you just generated to the IBM Content Manager Services for Lotus Quickr server and note the location.
      9. Open the WebSphere administration console on the IBM Content Manager Services for Lotus Quickr. Follow steps b and step c.
      10. Navigate to the Single sign-on section and re-enter the password you entered previously in step d .
      11. Type the full path to the LTPA key file from step h on the IBM Content Manager Services for Lotus Quickr Services server.
      12. Click OK and Save.
      13. Restart the Lotus Quickr 8.5 for WebSphere Portal server and the IBM Content Manager Services for Lotus Quickr WebSphere Application Server for the changes to take effect.

    [{"Product":{"code":"SSRS7Z","label":"IBM Content Manager Enterprise Edition"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Content Manager Services for Lotus Quickr","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.4.2.1;8.4.2;8.4.1.1;8.4.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

    Document Information

    Modified date:
    17 June 2018

    UID

    swg27018128

    Page Feedback