Desktop Web Access Single Sign-On Configuration Guide

Transcription

1 Waypoint Global Suite Single Sign-On relies on establishing a relationship between a Windows network user identity and a Suite user (Windows Authentication). This is accomplished by assigning to each of your Suite users a corresponding Windows network user logon. Windows Authentication In Desktop a user administrator can edit a user and click the "Use Windows Authentication" checkbox. This checkbox changes the user's configuration to no longer store a password in the database. Instead you identify the Windows domain and user that corresponds to the Suite user. From now on the President user can logon as CWTech\CWHarris or President and use their password stored in the Windows Network. Notes: User password rules are now enforced by the domain's rules including case-sensitivity, length and expiration. When using multiple domains, the user's domain must trust the workstations domain. There is a 1-to-1 relationship between a Suite user and a domain user. Multiple suite users may not use the same domain user name. The MASTER and QP9000ADMIN users may not be configured to use Windows Authentication. V /27/2015 1

2 Single Sign-On With Single Sign=On relies on Windows Authentication to identify the currently logged on user. When any Suite application or Desktop Web Access starts a search is done with the user s Windows identity to find their related Suite user. Single Sign-On is enabled by a user with master privileges from the System Preferences page Notes: For a user to take advantage of Single Sign-On their Suite user must be configured to use Windows Authentication (see above). A user may be configured to opt-out of using single sign on. Desktop Web Access is also compatible with Single Sign-On (see below) V /27/2015 2

3 Configuring Desktop Web Access For Single Sign-On Desktop Web Access Single Sign-On for Desktop Web Access is enabled by modifying configuration at the web server. 1. In the C:\DWAInstall directory. Set the SSOEnabled variable to true in the [DWAWEBAPP] section. If it is not in your INI, you can add it to the end of the section. The default is false. Save your changes. 2. Re-run the RunWDInstall.BAT file from the C:\DWAInstall directory. For Windows Server 2003 and 2008 you can double click to start the RunWDInstall.BAT. For Windows Server 2012 you will need to startup a Command Prompt as an Administrator. Change to the directory where the DWA Install was placed (CD \DWAInstall) and enter RunWDInstall at the command prompt. This will execute the install. (Continued ) V /27/2015 3

4 3. The WebDesktop web application s Authentication configuration must be edited using the Internet Information Services (IIS) Manager from the Administrative Tools folder in the Control Panel. Normally, the Anonymous Authentication and Forms Authentication are enabled. For Single Sign-On the Anonymous Authentication is disabled. The Forms Authentication and Windows Authentication both need to be enabled. Complete V /27/2015 4

5 Client Considerations Each client must be configured to use a User Authentication Logon that allows automatic logon. The default is Automatic logon on in Intranet zone. Finishing Up Now when going to any WebDesktop page while logged on as a user that has been configured to use Windows Authentication the DWALogon.ASPX page will be skipped. If you start up any WebDesktop page while logged on as a user that is not configured or has been configured to opt-out they will be taken directly to the DWALogon.ASPX page. Using the Logout link on any Desktop Web Access page will disable Single Sign-On for the duration of that browser s session. The Logout link will go to the DWALogon.ASPX page where you may logon as any other user. V /27/2015 5