Configure Single Sign-on for SAML - Precisely_EnterWorks - EnterWorks - 11.0

enable-web-server-service
enable-api-go-service

1. The create-scripts (create-<service-name>-service.cmd) are located in the following folder:

   <drive>:\Enterworks\enable2020\services\install\

2. Back up the create-service scripts for the affected services. Copy the following scripts:

   • create-enable-web-server-service.cmd

   • create-enable-api-go-service.cmd

   to:

   <drive>:\Backup

   To make possible future troubleshooting easier, rename the create-service scripts in the Backup folder by appending the date or datetime to the end of their filenames.

3. Edit the shared configuration properties as follows:

   • fromApp.secureAuth.trustedSignOn=true

   • fromApp.secureAuth.idp.type=3

4. Set the configuration parameters for enable-web-server-service:

   1. Edit the file:

      <drive>:\Enterworks\enable2020\services\install\create-enable-web-server-service.cmd

   2. If the setting -samlSsoSettings doesn't exist in the script, add it.
   3. Set the value of -samlSsoSettings to point to the IDP's metadata for enable2020 and webcm. The setting indicates if the locations of the metadata files are given as a file path or a URL. The metadata files do not have to both be in the same location. They also do not both have to be indicated the same way; one file's location can be stated as a file path and the other file's location can be stated as a URL. The format of the -samlSsoSettings string is:

      -samlSsoSettings=\"enable2020|<file or url>|<location of metadata>;webcm|<file or url>|<location of metadata>\"

      where:
      • <file or url> is the word "file" if <location of metadata> is a file path or the word "url" if <location of metadata> is a URL.

        Note: Using a URL is recommended due to its simplicity and ease of use.

      • <location of metadata> is the file path or URL of the metadata file.

      For example:

      -samlSsoSettings=\"enable2020|url|http://dev-xxx.oktapreview.com/<...>/sso/saml/metadata;webcm|file|<drive>:\EnterWorks\certs\saml\"

   4. If the setting -spHost doesn't exist in the script, add it.
   5. The setting -spHost must be set to the domain name indicated in the webapps.baseUrl setting in the shared configuration properties. For example, if:

      webapps.baseURL=https://<domain>.com/webcm/ 

      then set:

      -sphost=https://<domain>.com

   6. If you want to map attribute statements tags that are different than what EnterWorks expects:
      1. If you have not already created an SSO mapping file, Create the SSO Mapping File.
      2. Set the ssoMappingConfig parameter to indicate the location of the sso-mapping.json file:

         -ssoMappingConfig=<drive>:\Enterworks\enable2020\services\sso-mappings\

   7. If you want to configure SSO to use a token signing certificate, uncomment out the setting: samlSigningSPKeysPath and set it to indicate the location of the token_cert.pem certificate file:

      -samlSigningSPKeysPath=<drive>:\Enterworks\certs\saml

      For more information about how EnterWorks obtains a signing certificate, see Obtaining a Signing Certificate.
   8. Save the create-enable-web-server-service.cmd script.
   9. Use the create-enable-web-server-service.cmd script.

5. Set the configuration parameters for enable-api-go-service

   1. Open create-enable-api-go-service.cmd for editing.
   2. The setting -ssoEnabled has been deprecated. If it is present in the file, remove it.
   3. If the setting -ssoIndicator doesn't exist in the script, add it.
   4. Set the value of -ssoIndicator:
      • -ssoIndicator=2 (Recommended setting.) EnterWorks will only request that the IDP authenticates users. When an existing EnterWorks user logs into EnterWorks, EnterWorks will confirm with the IDP that the user exists in the IDP's directory. If the user exists, EnterWorks will allow the user to log in.

        Note: Ensure that the user is created in both the IDP directory and the EnterWorks application.
      • -ssoIndicator=1: (Default) Just In Time (JIT) provisioning (also known as Automatic provisioning). See Just In Time Provisioning.

        Note: The user will be created in the EnterWorks application as soon as they log in. You may need to verify the permissions for the created user.
   5. Save the script.
   6. Use the script.
6. Restart all services.