System Account tied to RSO

Question

Is it ok to change the configuration for system accounts to use an alternative user? In most cases, this would be prodikaadmin. While testing Reduced Sign-On, the prodikaadmin account cannot be used to login to the UI (since it's not currently setup in active directory) and is causing other issues based on what was configured in the Setup Assistant tool. Would adding prodikaadmin to an active directory group resolve this? Or what is the recommended process?
Thanks!

Answer 1

Unfortunately, our reference LDAP authentication strategy was not updated for the 6.1.1.1 release. It is missing some code. However, we have a way that you can get around this.
For your Prod environment, you will have to change your authentication configuration a little bit. We basically have an Authentication strategy that is composed of other authentication strategies, and it will handle the scenario where one of the authentication strategies (in this case, your LDAP one) doesn’t implement the new interface methods. Basically, it wraps your LDAP authentication safely, so that you don’t need to make any code changes in your LDAP class.
Here is what you should try:
You are going to change your AuthenticationStrategy to a new one, we’ll call CompositeLDAP.
You’ll add this CompositeLDAP as a new Authentication strategy to the AuthenticationStrategies node. This composite strategy has subnodes to say which of the other authentication strategies this should wrap/use.
So here we add a new IncludedStrategy node, and reference your RSO LDAP one. If your prod environment also used Prodika authentication for a prodikaadmin type user, then you would add another IncludedStrategy with the id of “Prodika”, but then you would have to change the allMustPass attribute value to false.
<AuthenticationService configChildKey="name">
                        <envvar name="UseTrustBridge" value="true" configAttributeOverrideBehavior="Replace"/>
                                <!-- Uncomment the following and fill in the LDAP server configuration to enable LDAP authentication -->
                                <envvar name="AuthenticationStrategy" value="CompositeLDAP" configAttributeOverrideModifier="IsLocked"/>
                                <envvar name="AuthenticationStrategies">
                                          <AuthenticationStrategy id="LDAP" ldapServer="LDAP://LDAP_SERVER:PORT" userDomain="DOMAIN"/>         
                                          <AuthenticationStrategy id="CompositeLDAP" 
factory="Class:Xeno.Prodika.Services.AuthenticationBridgeService.CompositeAuthenticationStrategyFactory,GeneralServices"
allMustPass="true">
<IncludedStrategy id="LDAP" />
</AuthenticationStrategy>
</envvar>
                                <envvar name="EncryptionScheme" value="SHA256" configAttributeOverrideModifier="IsLocked"/>
</AuthenticationService>
Hope that isn’t too confusing.
Give this a try, and let me know how it goes.
Regards,
Ron