Connect:Direct Proxy Single Sign-on configuration

Edit online

Secure Proxy can be used as a proxy with Sterling B2B Integrator and Sterling File Gateway and supports a single sign-on connection for Connect:Direct® connections. Single sign-on (SSO) bypasses the normal user authentication process in Sterling B2B Integrator and instead trusts that Secure Proxy has authenticated the user.

To support single sign-on, configure Sterling External Authentication Server to generate SSO tokens. Configuring SSO allows a trading partner to log on and use the same login session to connect to Secure Proxy and Sterling B2B Integrator. By default, Sterling External Authentication Server uses OpenSAML to create and manage SSO tokens. However, you can customize your environment to use a third-party application to generate tokens.

This topic describes how to configure the Connect:Direct protocol in Secure Proxy between the trading partner and Secure Proxy and between Secure Proxy and Sterling B2B Integrator to enable authentication through Sterling External Authentication Server. It describes how to configure Sterling External Authentication Server to issue tokens to authenticate the connection between Secure Proxy and Sterling B2B Integrator. It also describes how to configure a self-service Change Password Portal for external trading partners.

Flow of Data for Single Sign-On Configuration Between Sterling B2B Integrator and Secure Proxy

After you set up the basic single sign-on configuration, trading partners can communicate in a secure environment that provides authentication. The trading partner first connects to Secure Proxy which then connects to Sterling B2B Integrator on behalf of the trading partner.

Following is an illustration of the flow of data:



Following are the steps that occur during a single sign-on session between a trading partner, Secure Proxy, and Sterling B2B Integrator when Sterling External Authentication Server is used to generate and manage tokens:

  1. The trading partner requests a connection to Sterling B2B Integrator.
  2. Secure Proxy receives the request, and the SSL handshake between Secure Proxy and the trading partner begins. If SSL authentication is configured, the proxy submits its certificate to the trading partner. If client authentication is configured, the trading partner then submits its certificate to Secure Proxy for authentication. You can optionally configure Secure Proxy to enforce client authentication and send the certificate to Sterling External Authentication Server for validation.
  3. Secure Proxy sends an authentication request to the trading partner, who provides his user ID and password.
  4. Secure Proxy sends the user ID and password to Sterling External Authentication Server and then validates it against information stored in LDAP.
  5. If the credentials are valid, Sterling External Authentication Server creates an OpenSAML v2 token and returns the token to Secure Proxy.
  6. Secure Proxy connects to Sterling B2B Integrator and performs an SSL handshake. Secure Proxy then sends the request with the token from Sterling External Authentication Server to Sterling B2B Integrator.
  7. Sterling B2B Integrator validates the token against Sterling External Authentication Server and begins normal operation.

Configuration Considerations

Before you complete the single sign-on configuration, be aware of the following considerations:

  • Only the HTTP, Connect:Direct, FTP, and SFTP protocols support single sign-on connections.
  • When Secure Proxy is configured to use SSO and the Secure External Authentication Server user authentication profile is configured to return a mapped user ID, the mapped user ID, not the original user ID, and the SSO token are sent to the back-end system for user authentication.
  • The Secure Proxy Change Password Portal requires an HTTP adapter, which is an optional, licensed component of Secure Proxy, and a license for the Change Password Portal. Refer to Configure Change Password Portal instructions to configure this feature.
  • If you are using a load balancer to run multiple Secure Proxy engines, avoid login credential errors by configuring the load balancer to use persistence or "sticky connections." Refer to your load balancer documentation for details about configuring persistence.

Organization of Single Sign-On Scenarios

The scenarios describe how to configure single sign-on between Secure Proxy and trading partners and between Secure Proxy and Sterling B2B Integrator.