How to configure Single Sign-On (SSO) login in separate ARM Web Server

When ARM Web is installed on a different machine than the ARM server, additional configuration is required to enable Single Sign-On (SSO) authentication. This document outlines the configuration steps and necessary IIS and client settings to ensure seamless SSO integration

Part 1: Certificates and Configuration Files 

1. Verify the following files exist on the ARM Server:
   
   • GrantMA.config.xml in C:\ProgramData\protected-networks.com\8MAN\cfg
   • certificate.cer and certificate.pfx in C:\ProgramData\protected-networks.com\8MAN\cfg\security
2. If these files are missing:
   • Set the web components (Configure the web components). This will generate the files above.
3. Copy GrantMA.config.xml, certificate.cer, and certificate.pfx from the ARM server.
4. On the Web Server (hosting ARM Web), create a backup of the current GrantMA.config.xml, certificate.cer, and certificate.pfx files, then replace them with the copies from the ARM server.

Part 2: IIS Configuration

1. Open Internet Information Services (IIS) Manager on the web server.
2. Navigate to: Sites → ARM Web API → Authentication, make sure "Windows Authentication" is enabled.
   • 
3.  Right-click Windows Authentication → select Providers. Confirm the providers are listed as:
   • Negotiate
   • NTLM
     • 

Part 3: Client Configuration (Preventing Credential Prompts)

Note:

• Begin with configuration on the web server and test SSO access from client machines.
• If users are still prompted for credentials, apply the same configuration steps on the client machines.

For Microsoft Edge and Google Chrome

1. In your web browser, go to Internet Options and add the page to Trusted sites.
   • 
2. Adjust the level so that the user can automatically log in with the current username and password.
   • 

For Mozilla Firefox

1. In the URL address bar, enter: about:config
2. Search for network.automatic-ntlm-auth.trusted-urls
   • 
3. Enter the address for your web application.