Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Enterprise Single Sign-On 8.0.6 - SSOWatch Administrator Guide

Table of Contents

1.1 SSOWatch module of Quest ESSO: Basic Principles

1.1.1 Application Modeling 1.1.2 Application Access Profiles 1.1.3 Password Format Control Policies (PFCP) 1.1.4 Application Behavior 1.1.5 Window Types 1.1.6 LDAP Directories

1.2 The Access Collector Mode 1.3 SSOWatch Components

1.3.1 Enterprise SSO Studio 1.3.2 Quest Enterprise SSO Plug-ins

2.1 Overview 2.2 The SSOWatch Interface

2.2.1 QESSO SSOWatch Icon 2.2.2 SSOWatch Pop-up Menu 2.2.3 The SSOWatch Window

2.2.3.1 The "Account" Panel 2.2.3.2 The "Home" Panel

2.3 Starting/Quitting SSOWatch

2.3.1 Starting SSOWatch 2.3.2 Quitting SSOWatch

2.4 Suspending/Activating SSOWatch 2.5 Resetting SSOWatch Configuration 2.6 Managing User Accounts

2.6.1 Providing SSO Data When Launching an SSO Enabled Application for the First Time 2.6.2 Displaying your SSOWatch User Accounts 2.6.3 Displaying the Properties of a User Account 2.6.4 Changing the Login Name and/or Password of a User Account 2.6.5 Changing an Expired Primary Password 2.6.6 Creating a New Account for an Application 2.6.7 Deleting a User Account 2.6.8 Displaying User Account Password 2.6.9 Delegating a User Account

2.6.9.1 Delegating a User Account With the Wizard 2.6.9.2 Delegating a User Account Manually 2.6.9.3 Removing a User Account Delegation

2.7 Disabling/Enabling SSO for Applications 2.8 Requesting an Access to an Application Through the Request Manager Portal 2.9 Testing the SSO Configuration of an Application 2.10 Starting Personal SSO Studio 2.11 Starting an Application 2.12 Creating a Shortcut for an Application 2.13 Removing the Icon from the Notification Area

3 Configuration Editor: Enterprise SSO Studio

3.1 Interface Overview 3.2 Starting and Stopping Enterprise SSO Studio

3.2.1 Starting Enterprise SSO Studio 3.2.2 Stopping Enterprise SSO Studio

3.3 Creating or Opening a Configuration 3.4 Configuring General SSO Parameters 3.5 Defining PFCP and Application Profiles

3.5.1 Defining Password Format Control Policies (PFCP)

3.5.1.1 "Password Management Policy" Tab - Description 3.5.1.2 "Password Format Policy" Tab - Description

3.5.2 Defining the Application Profiles

3.5.2.1 Properties Tab of an Application Profile 3.5.2.2 Access Strategy Tab of an Application Profile 3.5.2.3 Delegation Tab of an Application Profile

3.6 Defining Application and Technical Definition Objects

3.6.1 Creating/Modifying Application Objects and Technical Definitions

3.6.1.1 Creating a New Application Object or Technical Definition 3.6.1.2 Modifying an Application Object or Technical Definition Configuration

3.6.2 Filling-in the Application Properties Window

3.6.2.1 "Properties" Tab of an Application Object 3.6.2.2 "Properties" Tab of a Technical Definition Object 3.6.2.3 "Account Base" Tab of an Application Object 3.6.2.4 "Launcher" Tab 3.6.2.5 "Parameters" Tab 3.6.2.6 "Application Profile" Tab

3.6.3 Defining Advanced Access Rights

3.7 Defining Window Objects

3.7.1 "General" Tab 3.7.2 "Options" Tab

3.7.2.1 Detection Criteria Area 3.7.2. Execution Options Area 3.7.2.3 Advanced Options area

3.7.3 "Detection" and "Actions" Tabs

3.8 Testing the SSO 3.9 Exporting or Importing Objects

3.9.1 Exporting/Importing Objects using the Graphical Interface 3.9.2 Importing Objects using Command Line Arguments (without Controller)

3.10 Managing Objects in the Tree

3.10.1 Copying/Cutting/Pasting Objects 3.10.2 Renaming an Object 3.10.3 Deleting an Object from the Tree

3.11 Saving Object Configurations

3.11.1 Saving Object Configurations in LDAP Storage Mode (with Controller) 3.11.2 Saving Object Configurations in Local Storage Mode

3.12 Managing Configuration Updates 3.13 Refreshing the Tree

4 The Generic Plug-in

4.1 Window Detection

4.1.1 Simple Detection

4.1.1.1 Simple Detection of a Window or a Java Applet 4.1.1.2 Simple Detection of a Web Page

4.1.2 Advanced Detection

4.1.2.1 The Enable Variable URL Detection Option 4.1.2.2 The Look for Text Option 4.1.2.3 The Advanced Button

4.1.3 Restrictions

4.2 User Interface

4.2.1 Target 4.2.2 Validation Actions

4.3 Generic Plug-in Actions

4.3.1 StandardLogin – Connection

4.3.1.1 Window Description 4.3.1.2 Specifying Additional Fields (Optional) 4.3.1.3 SSOWatch Behavior

4.3.2 BadPassword

4.3.2.1 Window Description 4.3.2.2 SSOWatch Behavior

4.3.3 NewPassword

4.3.3.1 Window Description 4.3.3.2 SSOWatch Behavior

4.3.4 ConfirmPassword

4.3.4.1 Window Description 4.3.4.2 SSOWatch Behavior

4.3.5 BadNewPassword

4.3.5.1 Window Description 4.3.5.2 SSOWatch Behavior

4.4 Special Cases

4.4.1 NotesLogin (Lotus Notes Plug-in)

4.4.1.1 Lotus Notes Identifier Format 4.4.1.2 Window Description 4.4.1.3 Configuring the Field Containing the Lotus Notes Login 4.4.1.4 SSOWatch Behavior

4.4.2 HTTP Authentication (Internet Explorer Plug-in)

4.4.2.1 Window Description 4.4.2.2 SSOWatch Behavior

5 The Microsoft Internet Explorer Plugin

5.1 HTML/Internet Explorer Detection

5.1.1 Variable URLs 5.1.2 Advanced Detection

5.2 User Interface

5.2.1 Selecting a Field in an HTML Form 5.2.2 Custom SSO Parameters 5.2.3 Submitting an HTML Form

5.2.3.1 Simple Submit / Button Click 5.2.3.2 Click a Link

5.3 HTML/Internet Explorer Actions

5.3.1 HTMLLogin – Connection

5.3.1.1 Configuration 5.3.1.2 Actions

5.3.2 HTMLBadPassword

5.3.2.1 Configuration 5.3.2.2 Actions

5.3.3 HTMLNewPassword

5.3.3.1 Configuration 5.3.3.2 Actions

5.3.4 HTMLBadNewPassword – New Password Refused

5.3.4.1 Configuration 5.3.4.2 Actions

6 The SAP R/3 Plug-in

6.1 SAPLogin and SAPExpired Window Types

6.1.1 SAPLogin (SAP R/3 Login) 6.1.2 SAPExpired (SAP R/3 Password Expiry)

6.2 Basic Principles of the SAP R/3 Plug-in 6.3 Configuration Guide

6.3.1 Configuring an SAP R/3 Application 6.3.2 Configuring the SAPGUI Scripting Window

6.3.2.1 The Detection Tab 6.3.2.2 The Actions Tab

7 Terminal Type Applications

7.1 Terminal 7.2 Microsoft Telnet 7.3 Banners

8 The HLLAPI Plug-in

8.1 Configuring the HLLAPI Plug-in

8.1.1 Configuring the HLLAPI Plug-in for a Single Application 8.1.2 Configuring the HLLAPI Plug-in for Different Types of Applications 8.1.3 HLLAPI Plug-in Registry Keys

8.2 Enabling SSO for HLLAPI Applications

8.2.1 The Detection Tab 8.2.2 The Actions Tab

8.3 HLLAPI Applications Keys

9 Advanced Configuration

9.1 Custom Scripts Plug-ins

9.1.1 Basic Concepts

9.1.1.1 Scripting Logic 9.1.1.2 Data "Buffer"

9.1.2 The Actions Tab 9.1.3 Script Editor

9.1.3.1 Script Editor Toolbar 9.1.3.2 Script Editor Actions

9.2 Extension DLL

9.2.1 Function Prototyping 9.2.2 SSOWatchSSOData Structure 9.2.3 Return Code

10 OLE/Automation Interface

10.1 Definition of SSOWatch OLE/Automation Interface 10.2 The ISSOEngine Interface

10.2.1 GetApplication2 10.2.2.GetSSOEngineState

10.3 The ISSOApplication Interface

10.3.1 Properties

10.3.1.1 The LoginId Property 10.3.1.2 The Password Property

10.3.2.1 The GetSSOParameter Method 10.3.2.2 The GetUserApplicationPassword Method 10.3.2.3 The GetNewPassword Method 10.3.2.4 The get_IsExpired Method

10.4 Code Example 10.5 Return Codes

Appendix A: Cache Tuning and Asynchronous Update of the Application Data

A.1 Cache and Application Update Mechanism

A.1.1 Cache Mechanism A.1.2 Asynchronous Update Mechanism

A.2 Cache and Update Timing Parameters

Appendix B: Integrating Care-FX with SSOWatch

B.1 Authentication Description

B.1.1 Logging On B.1.2 Logging Out

B.2 Configuring the Implementation

B.2.1 Activating the FCC Notification B.2.2 Integrating the COM Interface

5.3.4.1 Configuration

This properties page allows the definition of:

•	The validation method after a new password has been refused.

•	(Optional) The HTML field for the username, if re-authentication is proposed in the same window.

•	(Optional) The HTML field for the old password.

•	(Optional) The HTML field for the new password.

•	(Optional) The HTML field for new-password confirmation.

5.3.4.2 Actions

In SSOWatch, the actions which are performed following detection of this HTML page are:

•	The old password is reset and becomes the current password.

•	If specified, authentication is performed with the username and old password (if a multi-session application and a number of accounts are used, SSOWatch prompts the user to choose the appropriate session).

•	The user is prompted for a new password, or a new password is generated based on the application’s password policy (PFCP).

•	If confirmation of new password is specified, the new password is saved in the security database.

•	If unsuccessful, SSO is cancelled.

•	If successful, or where there is no confirmation:

•	The new password is sent (if specified).

•	Confirmation is sent (if specified).

•	The window is validated.

•	NewPassword type windows are activated.

6 The SAP R/3 Plug-in

This section gives a brief description of the SSOWatch SAP R/3 plug-in for SSOWatch.

The SAP R/3 plug-in provides different types of windows for the management of single sign-on, depending on the version of SAP R/3 clients and servers. To identify the window corresponding to each version of the SAP R/3 components, see Release Notes.

The SAPLogin and SAPExpired window types defined in version 3.71 of SSOWatch are still available, to ensure the continuity of deployed configurations. However, we recommend that these are ported to SAPGUI Scripting and Advanced SAPGUILogin window types.

6.1 SAPLogin and SAPExpired Window Types

•	6.1.1 SAPLogin (SAP R/3 Login)

•	6.1.2 SAPExpired (SAP R/3 Password Expiry)

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy