Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Enterprise Single Sign-On 8.0.6 - SSOWatch Administrator Guide

Table of Contents

1.1 SSOWatch module of Quest ESSO: Basic Principles

1.1.1 Application Modeling 1.1.2 Application Access Profiles 1.1.3 Password Format Control Policies (PFCP) 1.1.4 Application Behavior 1.1.5 Window Types 1.1.6 LDAP Directories

1.2 The Access Collector Mode 1.3 SSOWatch Components

1.3.1 Enterprise SSO Studio 1.3.2 Quest Enterprise SSO Plug-ins

2.1 Overview 2.2 The SSOWatch Interface

2.2.1 QESSO SSOWatch Icon 2.2.2 SSOWatch Pop-up Menu 2.2.3 The SSOWatch Window

2.2.3.1 The "Account" Panel 2.2.3.2 The "Home" Panel

2.3 Starting/Quitting SSOWatch

2.3.1 Starting SSOWatch 2.3.2 Quitting SSOWatch

2.4 Suspending/Activating SSOWatch 2.5 Resetting SSOWatch Configuration 2.6 Managing User Accounts

2.6.1 Providing SSO Data When Launching an SSO Enabled Application for the First Time 2.6.2 Displaying your SSOWatch User Accounts 2.6.3 Displaying the Properties of a User Account 2.6.4 Changing the Login Name and/or Password of a User Account 2.6.5 Changing an Expired Primary Password 2.6.6 Creating a New Account for an Application 2.6.7 Deleting a User Account 2.6.8 Displaying User Account Password 2.6.9 Delegating a User Account

2.6.9.1 Delegating a User Account With the Wizard 2.6.9.2 Delegating a User Account Manually 2.6.9.3 Removing a User Account Delegation

2.7 Disabling/Enabling SSO for Applications 2.8 Requesting an Access to an Application Through the Request Manager Portal 2.9 Testing the SSO Configuration of an Application 2.10 Starting Personal SSO Studio 2.11 Starting an Application 2.12 Creating a Shortcut for an Application 2.13 Removing the Icon from the Notification Area

3 Configuration Editor: Enterprise SSO Studio

3.1 Interface Overview 3.2 Starting and Stopping Enterprise SSO Studio

3.2.1 Starting Enterprise SSO Studio 3.2.2 Stopping Enterprise SSO Studio

3.3 Creating or Opening a Configuration 3.4 Configuring General SSO Parameters 3.5 Defining PFCP and Application Profiles

3.5.1 Defining Password Format Control Policies (PFCP)

3.5.1.1 "Password Management Policy" Tab - Description 3.5.1.2 "Password Format Policy" Tab - Description

3.5.2 Defining the Application Profiles

3.5.2.1 Properties Tab of an Application Profile 3.5.2.2 Access Strategy Tab of an Application Profile 3.5.2.3 Delegation Tab of an Application Profile

3.6 Defining Application and Technical Definition Objects

3.6.1 Creating/Modifying Application Objects and Technical Definitions

3.6.1.1 Creating a New Application Object or Technical Definition 3.6.1.2 Modifying an Application Object or Technical Definition Configuration

3.6.2 Filling-in the Application Properties Window

3.6.2.1 "Properties" Tab of an Application Object 3.6.2.2 "Properties" Tab of a Technical Definition Object 3.6.2.3 "Account Base" Tab of an Application Object 3.6.2.4 "Launcher" Tab 3.6.2.5 "Parameters" Tab 3.6.2.6 "Application Profile" Tab

3.6.3 Defining Advanced Access Rights

3.7 Defining Window Objects

3.7.1 "General" Tab 3.7.2 "Options" Tab

3.7.2.1 Detection Criteria Area 3.7.2. Execution Options Area 3.7.2.3 Advanced Options area

3.7.3 "Detection" and "Actions" Tabs

3.8 Testing the SSO 3.9 Exporting or Importing Objects

3.9.1 Exporting/Importing Objects using the Graphical Interface 3.9.2 Importing Objects using Command Line Arguments (without Controller)

3.10 Managing Objects in the Tree

3.10.1 Copying/Cutting/Pasting Objects 3.10.2 Renaming an Object 3.10.3 Deleting an Object from the Tree

3.11 Saving Object Configurations

3.11.1 Saving Object Configurations in LDAP Storage Mode (with Controller) 3.11.2 Saving Object Configurations in Local Storage Mode

3.12 Managing Configuration Updates 3.13 Refreshing the Tree

4 The Generic Plug-in

4.1 Window Detection

4.1.1 Simple Detection

4.1.1.1 Simple Detection of a Window or a Java Applet 4.1.1.2 Simple Detection of a Web Page

4.1.2 Advanced Detection

4.1.2.1 The Enable Variable URL Detection Option 4.1.2.2 The Look for Text Option 4.1.2.3 The Advanced Button

4.1.3 Restrictions

4.2 User Interface

4.2.1 Target 4.2.2 Validation Actions

4.3 Generic Plug-in Actions

4.3.1 StandardLogin – Connection

4.3.1.1 Window Description 4.3.1.2 Specifying Additional Fields (Optional) 4.3.1.3 SSOWatch Behavior

4.3.2 BadPassword

4.3.2.1 Window Description 4.3.2.2 SSOWatch Behavior

4.3.3 NewPassword

4.3.3.1 Window Description 4.3.3.2 SSOWatch Behavior

4.3.4 ConfirmPassword

4.3.4.1 Window Description 4.3.4.2 SSOWatch Behavior

4.3.5 BadNewPassword

4.3.5.1 Window Description 4.3.5.2 SSOWatch Behavior

4.4 Special Cases

4.4.1 NotesLogin (Lotus Notes Plug-in)

4.4.1.1 Lotus Notes Identifier Format 4.4.1.2 Window Description 4.4.1.3 Configuring the Field Containing the Lotus Notes Login 4.4.1.4 SSOWatch Behavior

4.4.2 HTTP Authentication (Internet Explorer Plug-in)

4.4.2.1 Window Description 4.4.2.2 SSOWatch Behavior

5 The Microsoft Internet Explorer Plugin

5.1 HTML/Internet Explorer Detection

5.1.1 Variable URLs 5.1.2 Advanced Detection

5.2 User Interface

5.2.1 Selecting a Field in an HTML Form 5.2.2 Custom SSO Parameters 5.2.3 Submitting an HTML Form

5.2.3.1 Simple Submit / Button Click 5.2.3.2 Click a Link

5.3 HTML/Internet Explorer Actions

5.3.1 HTMLLogin – Connection

5.3.1.1 Configuration 5.3.1.2 Actions

5.3.2 HTMLBadPassword

5.3.2.1 Configuration 5.3.2.2 Actions

5.3.3 HTMLNewPassword

5.3.3.1 Configuration 5.3.3.2 Actions

5.3.4 HTMLBadNewPassword – New Password Refused

5.3.4.1 Configuration 5.3.4.2 Actions

6 The SAP R/3 Plug-in

6.1 SAPLogin and SAPExpired Window Types

6.1.1 SAPLogin (SAP R/3 Login) 6.1.2 SAPExpired (SAP R/3 Password Expiry)

6.2 Basic Principles of the SAP R/3 Plug-in 6.3 Configuration Guide

6.3.1 Configuring an SAP R/3 Application 6.3.2 Configuring the SAPGUI Scripting Window

6.3.2.1 The Detection Tab 6.3.2.2 The Actions Tab

7 Terminal Type Applications

7.1 Terminal 7.2 Microsoft Telnet 7.3 Banners

8 The HLLAPI Plug-in

8.1 Configuring the HLLAPI Plug-in

8.1.1 Configuring the HLLAPI Plug-in for a Single Application 8.1.2 Configuring the HLLAPI Plug-in for Different Types of Applications 8.1.3 HLLAPI Plug-in Registry Keys

8.2 Enabling SSO for HLLAPI Applications

8.2.1 The Detection Tab 8.2.2 The Actions Tab

8.3 HLLAPI Applications Keys

9 Advanced Configuration

9.1 Custom Scripts Plug-ins

9.1.1 Basic Concepts

9.1.1.1 Scripting Logic 9.1.1.2 Data "Buffer"

9.1.2 The Actions Tab 9.1.3 Script Editor

9.1.3.1 Script Editor Toolbar 9.1.3.2 Script Editor Actions

9.2 Extension DLL

9.2.1 Function Prototyping 9.2.2 SSOWatchSSOData Structure 9.2.3 Return Code

10 OLE/Automation Interface

10.1 Definition of SSOWatch OLE/Automation Interface 10.2 The ISSOEngine Interface

10.2.1 GetApplication2 10.2.2.GetSSOEngineState

10.3 The ISSOApplication Interface

10.3.1 Properties

10.3.1.1 The LoginId Property 10.3.1.2 The Password Property

10.3.2.1 The GetSSOParameter Method 10.3.2.2 The GetUserApplicationPassword Method 10.3.2.3 The GetNewPassword Method 10.3.2.4 The get_IsExpired Method

10.4 Code Example 10.5 Return Codes

Appendix A: Cache Tuning and Asynchronous Update of the Application Data

A.1 Cache and Application Update Mechanism

A.1.1 Cache Mechanism A.1.2 Asynchronous Update Mechanism

A.2 Cache and Update Timing Parameters

Appendix B: Integrating Care-FX with SSOWatch

B.1 Authentication Description

B.1.1 Logging On B.1.2 Logging Out

B.2 Configuring the Implementation

B.2.1 Activating the FCC Notification B.2.2 Integrating the COM Interface

4.4.1.1 Lotus Notes Identifier Format

The Lotus Notes identifier (or username) may be stored in the Quest ESSO security database using Lotus Notes formats (username, account name, Lotus Notes canonic name).

4.4.1.2 Window Description

This tabbed panel is pre-configured and should not be modified. However, if the SSOWatch Engine actions do not work with the preconfigured parameters, drag and drop the target buttons onto the target fields of the Lotus Notes login window, and if required, modify the preconfigured parameters.

4.4.1.3 Configuring the Field Containing the Lotus Notes Login

The first field is the one that contains the Lotus Notes username (Enter the password of…). The field must be selected using the target button.

In the field where the complete Lotus username is shown, ensure that all entries are deleted, and that only the

symbol remains.

Select the password field using the target button.

Ensure that the automatic window validation field is not checked.

When only one Notes account is accessed from the workstation, you may check the automatic window validation field. We recommend that this only be used in personal configuration mode.

4.4.1.4 SSOWatch Behavior

In SSOWatch, the following actions are performed after the window has been detected:

•	The Lotus Notes identifier is retrieved from the field as shown above.

•	A search is conducted for the account name in all the accounts associated with the application (beginning with full names):

•	If necessary, the user will have to choose between the accounts that match (or those that have no data associated with them).

•	If a single account matches (or has no data), SSOWatch will prompt the user for the associated password and will save it in the security database (collect).

•	The password is sent to the password field.

•	The window is validated; if the automatic validation option has not been selected in the configuration.

•	BadPassword and NewPassword window types are activated.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy