IBM Content Navigator, Version 2.0.3

Support for Single Sign-on (SSO)

IBM® Content Navigator supports single sign-on (SSO) for IBM FileNet® P8, IBM Content Manager, and IBM Content Manager OnDemand repositories. However, the supported SSO methods are different for each type of repository. Additionally, other IBM Content Navigator components support or require SSO.

The SSO method that is supported for each IBM Content Navigator component varies depending on the type of repository that the component connects to and the web application server on which the component is deployed.

Restriction: Some components are not supported on all of the versions of the web application servers that are supported by IBM Content Navigator. For example, task manager is not supported on IBM WebSphere® Application Server, Version 7.0. For more information about which components are supported on each web application server, see Planning for your web application server.

SSO for IBM Content Navigator components that connect to IBM FileNet P8 repositories

The SSO method that is supported for IBM FileNet P8 repositories requires the use of an additional SSO technology, such as Tivoli® Access Manager for e-business, SPNEGO/Kerberos, or CA SiteMinder. The exception to this rule is IBM CMIS for FileNet Content Manager, which supports only the use of LTPA and LDAP (on WebSphere Application Server) or trust between domains (on Oracle WebLogic Suite) for SSO.

If you use IBM Content Navigator to connect to only IBM FileNet P8 repositories, you can configure the IBM Content Navigator web client to use SSO and then deploy IBM Content Navigator to an SSO environment.

Restriction: If you use IBM Content Navigator with IBM Content Manager or IBM Content Manager OnDemand, the SSO settings for the IBM FileNet P8 repositories do not work.

WebSphere Application Server deployments

The following table describes the supported and unsupported SSO technologies for IBM Content Navigator components that connect to IBM FileNet P8 repositories:

Table 1. Supported SSO technologies on WebSphere Application Server
SSO provider	IBM Content Navigator web client	IBM Content Navigator for Microsoft Office desktop client	IBM Content Navigator Sync desktop client	IBM CMIS for FileNet Content Manager web application	IBM FileNet Collaboration Services web application
Tivoli Access Manager for e-business	✓				✓
Security Assertion Markup Language (SAML)	✓
IBM Security Access Manager (ISAM 7.0)	✓
SPNEGO/Kerberos	✓	✓ Remember: This component is not deployed to your web application server.	✓ Remember: This component is not deployed to your web application server. However, the sync services are deployed with the IBM Content Navigator web client.		✓
CA SiteMinder	✓				✓
LTPA and LDAP				✓ Important: You must configure LTPA and LDAP when you configure and deploy IBM CMIS for FileNet Content Manager. Therefore, no additional tasks are required to configure IBM CMIS for FileNet Content Manager for SSO.

See the following documents on the IBM Support site for information on configuring SSO solutions on WebSphere Application Server:

Tivoli Access Manager for e-business SSO: Configuring single sign-on for IBM Content Navigator by using Tivoli Access Manager for e-business (IBM FileNet P8)
Security Assertion Markup Language (SAML): Configuring single sign-on for IBM Content Navigator by using Security Assertion Markup Language (SAML) with Tivoli Federated Identity Manager on WebSphere Application Server
IBM Security Access Manager (ISAM 7.0): Configuring single sign-on for IBM Content Navigator by using IBM Security Access Manager (ISAM 7.0) on WebSphere Application Server
SPNEGO/Kerberos SSO: Configuring single sign-on for IBM Content Navigator by using SPNEGO/Kerberos on WebSphere Application Server (IBM FileNet P8)
CA SiteMinder SSO: Configuring single sign-on for IBM Content Navigator by using CA SiteMinder on WebSphere Application Server (IBM FileNet P8)

Oracle WebLogic Server deployments

The following table describes the supported and unsupported SSO technologies for IBM Content Navigator components that connect to IBM FileNet P8 repositories:

Table 2. Supported SSO technologies on Oracle WebLogic Server
SSO provider	IBM Content Navigator web client	IBM Content Navigator for Microsoft Office desktop client	IBM Content Navigator Sync desktop client	IBM CMIS for FileNet Content Manager web application	IBM FileNet Collaboration Services web application
Tivoli Access Manager for e-business					This component is not supported on Oracle WebLogic Server
Security Assertion Markup Language (SAML)					This component is not supported on Oracle WebLogic Server
IBM Security Access Manager (ISAM 7.0)					This component is not supported on Oracle WebLogic Server
SPNEGO/Kerberos	✓	✓ Remember: This component is not deployed to your web application server.	✓ Remember: This component is not deployed to your web application server. However, the sync services are deployed with the IBM Content Navigator web client.		This component is not supported on Oracle WebLogic Server
CA SiteMinder	✓				This component is not supported on Oracle WebLogic Server
Trust between domains				✓ Important: If you plan to deploy Content Platform Engine or Content Engine and IBM CMIS for FileNet Content Manager in different domains, you must enable trust between the domains. IBM CMIS for FileNet Content Manager supports Cross Domain Security or Global Trust.

See the following documents on the IBM Support site for information on configuring SSO solutions on Oracle WebLogic Server:

SPNEGO/Kerberos SSO: Configuring single sign-on for IBM Content Navigator by using SPNEGO/Kerberos on Oracle WebLogic Server (IBM FileNet P8)
CA SiteMinder SSO: For more information on configuring CA SiteMinder on WebSphere Application Server, see Configuring single sign-on for IBM Content Navigator by using CA SiteMinder on WebSphere Application Server (IBM FileNet P8) on the IBM Support Site.

See the following topic in the IBM Content Navigator documentation for enabling trust between Oracle WebLogic Server domains: Enabling trust between the Content Platform Engine domain and the IBM Content Navigator domain.

SSO for IBM Content Navigator using Security Assertion Markup Language (SAML)

The following table describes the supported and unsupported Identity Providers (IdPs) for IBM Content Navigator components that connect using Security Assertion Markup Language (SAML).

Table 3. Supported SSO technologies using Security Assertion Markup Language (SAML)
Identity Providers (IdPs)	IBM Content Navigator web client	Further information
IBM Tivoli Federated Identity Manager	✓
Active Directory Federation Services		Important: This Identity Provider is not supported for IBM Content Navigator version 2.0.3
ping Federate		Important: This Identity Provider is not supported for IBM Content Navigator version 2.0.3

SSO for IBM Content Navigator components that connect to IBM Content Manager repositories

The SSO method that is supported for IBM Content Manager repositories requires you to configure trusted logon on your IBM Content Manager library server and LDAP on WebSphere Application Server.

The following table describes which IBM Content Navigator components that connect to IBM Content Manager repositories can be used with SSO:

Table 4. SSO support for IBM Content Navigator components connecting to IBM Content Manager repositories
SSO Method	IBM Content Navigator web client	IBM Content Navigator for Microsoft Office desktop client	IBM CMIS for Content Manager web client
Trusted logon and LDAP	✓		✓

If trusted logon and LDAP are configured, you can configure the IBM Content Navigator client to use SSO to log on to IBM Content Manager repositories. For more information, see Configuring single sign-on for IBM Content Navigator (IBM Content Manager).

SSO for IBM Content Manager OnDemand

The SSO method that is supported for IBM Content Manager OnDemand repositories requires you to create a security user exit to authenticate users.

The following table describes which IBM Content Navigator components that connect to IBM Content Manager OnDemand repositories can be used with SSO:

Table 5. SSO support for IBM Content Navigator components connecting to IBM Content Manager OnDemand repositories
SSO Method	IBM Content Navigator web client	IBM CMIS for Content Manager OnDemand web client
Security user exit	✓

For more information on creating a security user exit, see the following topics in the IBM Content Manager OnDemand documentation: