Security Compliance

Prerequisites for single sign-on configuration in ARM

This article provides steps to configure single sign-on (SSO) for Access Rights Manager (ARM) web applications in the browser.

First published date

5/6/2019 8:02 PM

Last published date

4/11/2023 8:15 AM

Overview

This article explains how to configure single sign-on (SSO) for Access Rights Manager (ARM) web applications in the browser when there are problems with the login.

Product section

Access Rights Manager

Cause

  • Specific domain policies may require entering the password manually even after trying to log in with SSO.

Resolution

 
  • If you updated the web components and did not reinstall the grantMA site check the configurations below in the IIS.


Part 1: Server IIS Configuration
1. Enable Windows Authentication for SSO on the Grant MA page (relevant only for ARM 2019.4 and 2020.2).

2. On the Grant MA page, deactivate Windows Authentication and activate Anonymous Authentication. (relevant only for ARM 2019.4 and 2020.2)
3. Load the user profile in the Application pool.
-The settings from here and below are relevant for all the ARM versions in specific configurations

***IMPORTANT NOTE***
Since ARM 2021.4 the route definition was changed to /auth/Windows. Following the link below the user will be directly logged in to the ARM Web Dashboard.

https://<ARMServerFQDN>/auth/Windows
Please replace the <ARMServerFQDN> with the related FQDN.



4. Adjust the security settings on the server so that the computer and user accounts can be trusted for delegation purposes (secpol.msc).
Note: The installation of Grant MA web components includes an additional pair of certificates, which are located at: %ProgramData%\protected-networks.com\ 8MAN\cfg\security. We recommend that you do not change them.

5. Ensure that the SPN/UPN attribute of the ARM Service account object and of the user logging in, is set. On SSO we pick the user from the current windows context and check on the server side if it is really existing.

Part 2: Client Configuration
1. In your web browser, go to Internet Options and add the page to Trusted sites.

2. Adjust the level so that the user can automatically log in with the current username and password.

With these settings, you can now use SSO with Microsoft Edge and Google Chrome.

In Firefox, there is an additional setting required, which you can adjust at your own risk:

1. In the URL address bar, enter: about:config
2. Search for network.automatic-ntlm-auth.trusted-urls

3. Enter the address for your web application.

With this configuration added, you can now also use Firefox with SSO.