# Single Sign-On to TS

Different ways to sign in to a TS application, using an external IDP.

# Token login for apps

The URL of the service is **/token**

The following parameters are supported

- create
- login 
    - redirect
- renew

For safety allways use HTTPS and only use POST method for transmitting the token

### <span class="mw-headline" id="bkmrk-using-the-token-serv-1">Using the token service</span>

#### <span class="mw-headline" id="bkmrk-create-1">create</span>

Returns a token that can be used for login.

```
https://site.acme.com/TempusServa/token?create
```

```
c8d10470f211c21794849ad0c3aab154
```

#### <span class="mw-headline" id="bkmrk-login-1">login</span>

Creates a session for the user and redirects to the front page

```
https://site.acme.com/TempusServa/token?login=c8d10470f211c21794849ad0c3aab154
```

```
Directs to: https://site.acme.com/TempusServa/main
```

Additionally a custom page can be selected

```
https://site.acme.com/TempusServa/token?login=c8d10470f211c21794849ad0c3aab154&redirect=main?command=com.acme.tspages.CustomPage
```

```
Directs to: https://site.acme.com/TempusServa/main?command=com.acme.tspages.CustomPage
```

#### <span class="mw-headline" id="bkmrk-renew-1">renew</span>

Removes old token and creates a new one

```
https://site.acme.com/TempusServa/token?renew=c8d10470f211c21794849ad0c3aab154
```

```
098f6bcd4621d373cade4e832627b4f6
```

#### <span class="mw-headline" id="bkmrk-delete-1">delete</span>

Removes old token and creates a new one

```
https://site.acme.com/TempusServa/token?delete=c8d10470f211c21794849ad0c3aab154
```

# Windows (AD) Authentication

## <span class="mw-headline" id="bkmrk-understanding-ad-int-1">Understanding AD integration</span>

SSO happens between three entities in the same network domain:

- Tomcat server with TempusServa
- Domain controller (Active Directory)
- Client machine with a user 
    - authenticated against the domain controller
    - accessing the TempusServa installation

After the initial contact with the user TempusServa validates the original AD authentication, and logs in the user if a matching username can be found. Optionally TempusServa can synchronize group memberships using regular LDAP querying.

The recommended approach for Tomcat is using a SPNEGO servlet filter mapped to the TempusServa login page. Other integrations methods include

- Waffle (support for other servers)
- Tomcat 7 native SPNEGO

## <span class="mw-headline" id="bkmrk-installing-the-spneg-1">Installing the SPNEGO servlet filter</span>

Note the following guide is for Tomcat 6 or higher.

### <span class="mw-headline" id="bkmrk-installation-part-1-1">Installation part 1</span>

The first part of the installation ensures the basic SSO communication is in place.

1. [Run pre flight checklist](http://spnego.sourceforge.net/pre_flight.html)
2. [Run installation](http://spnego.sourceforge.net/spnego_tomcat.html)

Troubleshooting

- Check Tomcat is running in the same context as the domain user
- Ensure only one SPN exists (with fully qualified name)

After a succesfull test you should remove the jsp test file.

### <span class="mw-headline" id="bkmrk-installation-part-2-1">Installation part 2</span>

The second part of the installation ensures TempusServa logs in the user based on the Windows authenticated username.

Install the SPNEGO filter on the TempusServa application

1. Copy filter setting from the guide to **&lt;Tomcat&gt;\\webapps\\&lt;Application&gt;\\WEB-INF\\web.xml**
2. Change the filter mapping from \*.jsp to the login page

```xml
<filter-mapping>
    <filter-name>SpnegoHttpFilter</filter-name>
    <url-pattern>/login</url-pattern>
</filter-mapping>
```

Configure TempusServa to accept SSO by changing system configuration

```
ssoSpnegoAuthenticate = true
```

Finally restart Tomcat

### <span class="mw-headline" id="bkmrk-testing-the-setup-1">Testing the setup</span>

Find a suitable user

- Must exist as a Domain User in the AD server (ex. "TESTDOMAIN\\DrStrangelove" )
- Must exist as a user in Tempus Serva (ex. "DrStrangelove")

Login to a machine connected to the Domain controller

Navigate to the TempusServa login page and check if you are logged in and redirected to the main page.

Other results

- Login displayed with "Login failed" message: The SPNEGO is working but it was not possible to match the Windows authenticated user to a (valid) user in the Tempus Serva database
- Login displayed without any messages: The SPNEGO is NOT working or is deactivated