SSO with WIA not working yet...

Question

Hi,
We are trying to deploy SSO in our PT 5.0.2 portal (running on Windows 2000), but have not been able to get it to work
successfully yet. Microsoft Active Directory 2000 is our user/group source.
The server architecture is as follows:
Server A = Serves as Admin Portal, Portal Server, and Image Server (resides in the DMZ)Server B = Serves as Automation Server (resides inside the firewall)Server C = Serves as Database Server (running SQL Server 2000; resides inside the firewall)Server D = Serves as the Application Server (portlets reside on this server; resides in the DMZ)
All servers reside in the SAME domain.
This is what we have done so far:
1. Installed prerequisite software (i.e. IIS 5.0 and .NET Framework 1.1.4322) on Server C. Successfully installed and
configured the Active Directory Authentication Web Service (i.e. PT Optional Enterprise Web Component) on Server C.
2. Imported the above Web component, ADAWS, into Server A, using the PT Migration Wizard. This automatically created a
"Remote Server" and 2 "Web Services" (namely Authentication Web Service and Profile Web Service) objects on Server A.
3. Created a "Authentication Source - Remote" on Server A. The value in the "Authentication Source Category: " field is
EXACTLY the same as the Active Directory Source Domain. Selected "Authentication and Synchronization" as the Synchronization
setting, and "Full Synchronization."
4. Created a Job and added the above Remote Auth Source as the operation. The JOb ran successfully and imported all users and
groups from Active Directory.
5. Users can successfully login to the portal using the above Remote Auth Source (User ID example: Domain\joe_user).
6. Enabled "Integrated Windows Authentication" ONLY on the "\portal\sso" folder in Internet Services Manager on Server A.
Ensured that the security is set to "Anonymous" on "\portal" and "\portal\bin" folders.
7. Enabled SSO in the Portal, by entering the SSO Secret key in the SSO tab in the PT Admin Applet on Server A.
8. Created a "Authentication Source - SSO" on Server A. Entered the same SSO Secret key entered above and successfully
validated it.
9. Configured SSO integration with Windows Integrated Authentication (WIA) by editing the PTconfig.xml file. The edits are as
follows:
<SSOVendor value="5"/><DefaultAuthSourcePrefix value=""/><CookieDomain value=".companyname.com" />
NOTE: I did not have to edit the "sso.xml" file since the Auth Source category is EXACTLY the same as the Active Directory
Source Domain.
10. Edited the "Authentication Source - Remote" that we created in step 3 above, and changed the setting to
"Synchronization." And then selected the "Authentication Source - SSO" (created in step 8 above) from the "Authentication
Partners: " drop down list.
11. Users can still successfully login to the portal using the Remote Authentication Source after the above change.
12. Server D hosts a remote portlet. It is an IFRAME portlet (written in ASP) that has "href" links to several apps that
reside on Server D. The security on the folder, that contains this portlet, in Internet Services Manager, is set to
"Integrated Windows Authentication." Created a "Remote Server" object for Server D on Server A. Then created a "Web Service -
Remote Portlet" object for the portlet. In the Web Service, I selected the Remote server that I created, and entered only the
remaining path to the portlet (i.e. Portlet URL setting), since PT provided the "http://serverD/" portion. Finally created a
"Portlet" object.
13. users login to the portal using their domain ID (i.e. Domain\joe_user). They are then able to add the portlet to their
page. But when they attempt to click on the links in the portlet they are challenged to enter their user name and password
again.
What step or setting are we missing here? Any help will be sincerely appreciated.
Best regards,Kiran

Answer 1

Hi Rajendrakumar,
You probably haven't updated the ACL properly via STRUSTSS02.
The portal server digitally signs logon tickets as it issues them to the portal users. SAP Systems need to accept the tickets and verify the portal server’s digital signature. The following information is important for the SAP System to be able to accept and verify logon tickets:
·        The SAP System should only accept logon tickets issued from their designated portal server. Therefore, the identity of the portal server needs to be entered in the SAP System’s Single Sign-On (SSO) access control list (ACL).
·        The SAP System needs to be able to verify the portal server’s digital signature. The portal server has a self-signed certificate, therefore the SAP System needs access to the portal server’s public-key information, which needs to be entered in the SAP System’s certificate list.
Check the following procedure
http://help.sap.com/saphelp_nw70/helpdata/en/78/f1a8490e7011d6999500508b6b8a93/frameset.htm
Regards,
Siddhesh