Configure a Single Sign-on Connection to an HTTP Server

Edit online

Secure Proxy can be used as a proxy with Sterling File Gateway and other HTTP applications and supports a single sign-on connection. Single sign-on (SSO) provides access control that allows a user to log in once to Secure Proxy, using the HTTP protocol, and then gain access to Sterling File Gateway without logging in again. Single sign-on (SSO) bypasses the normal user authentication process in Sterling File Gateway and instead trusts that Secure Proxy has authenticated the user.

To support single sign-on, configure a Secure Proxy Login page and Sterling External Authentication Server to generate SSO tokens. Configuring SSO allows a trading partner to log on and use the same login session to connect to Secure Proxy and Sterling File Gateway. By default, Sterling External Authentication Server uses OpenSAML to create and manage SSO tokens. However, you can customize your environment to use a third-party application to generate tokens.

This topic describes how to configure the HTTP protocol in Secure Proxy between the trading partner and Secure Proxy and between Secure Proxy and Sterling File Gateway to enable authentication through Sterling External Authentication Server. It also describes how to configure Sterling External Authentication Server to issue tokens to authenticate the connection between Secure Proxy and Sterling File Gateway, without the need to log in again for this connection.

Flow of Data for Single Sign-On Configuration Between Sterling File Gateway and Secure Proxy

After you set up the basic single sign-on configuration, trading partners can communicate in a secure environment that provides authentication. The trading partner first connects to Secure Proxy which then connects to Sterling File Gateway on behalf of the trading partner.

Following is an illustration of the flow of data:


Flow of Data for Single Sign-On Configuration Between Sterling File Gateway and Secure Proxy

Following are the steps that occur during a single sign-on session between a trading partner, Secure Proxy, and Sterling File Gateway when Sterling External Authentication Server is used to generate and manage tokens:
  1. The trading partner requests a connection to Sterling File Gateway.
  2. Secure Proxy receives the request, and the SSL handshake between Secure Proxy and the trading partner begins. If SSL authentication is configured, the proxy submits its certificate to the trading partner. If client authentication is configured, the trading partner then submits its certificate to Secure Proxy for authentication. You can optionally configure Secure Proxy to enforce client authentication and send the certificate to Sterling External Authentication Server for validation.
  3. Secure Proxy presents a Login page to the trading partner, who provides his user ID and password. If the HTTP policy is configured to use basic authentication, Secure Proxy sends an unauthorized response and the browser displays the browser user ID/password prompt.
  4. Secure Proxy sends either the user ID and password to Sterling External Authentication Server, and then validates this against information stored in LDAP.
  5. If the credentials are valid, Sterling External Authentication Server creates an OpenSAML v2 token and Secure Proxy returns the a cookie associated with the token to the trading partner.
  6. The trading partner sends an HTTP request to Secure Proxy and includes the cookie.
  7. Secure Proxy checks for the cookie and validates the token using Sterling External Authentication Server.
  8. Secure Proxy then connects to Sterling File Gateway and performs an SSL handshake. It then sends the HTTP request with the cookie from the trading partner to Sterling File Gateway.
  9. Sterling File Gateway then validates the token against Sterling External Authentication Server and begins normal operation.

Configuration Considerations

Before you complete the single sign-on configuration, be aware of the following considerations:
  • Only the HTTP, Connect:Direct®, FTP, and SFTP protocols support single sign-on connections.
  • When Secure Proxy is configured to use SSO and the Sterling External Authentication Server user authentication profile is configured to return a mapped user ID, the mapped user ID, not the original user ID, and the SSO token are sent to the back-end system for user authentication.
  • Each single sign-on user you create in Sterling File Gateway must be modified in the Sterling B2B Integrator User Accounts as an External user with the correct Authentication Host. Secure Proxy uses the specified Authentication Host to authenticate the user.
  • The myFileGateway, FileGateway, and Sterling B2B Integrator dashboard users use application authentication in the HTTP policy.
  • The Sterling B2B Integrator AS2 and WebDav users use basic authentication in the HTTP policy.
  • Customize the Secure Proxy Login page-When you configure the basic scenario and select Application Authentication in the HTTP policy, you use the default Secure Proxy Login page. The default page provides basic information, including user name and password. To customize this page, to include additional information and your logo, complete the procedure, Customize the Login Page.
  • If you are using a load balancer to run multiple Secure Proxy engines, avoid login credential errors by configuring the load balancer to use persistence or "sticky connections." Refer to your load balancer documentation for details about configuring persistence.