Introduction

SSO (Single Sign-On) is a session and user authentication service that permits a user to utilize one set of login credentials - a username and password, to access multiple applications.

Benefits of using single sign-on include:

• Mitigate risk for access to 3rd-party sites (user passwords not stored or managed externally)

• Reduce password fatigue from different username and password combinations

• Reduce time spent re-entering passwords for the same identity

• Reduce IT costs due to lower number of IT help desk calls about passwords

Witness uses a plugin on the Management Server to check the specific authentication credentials for an individual user against a dedicated SSO directory server. The server authenticates the end user and provides details on group membership so they are given the appropriate permissions within the Witness application. This also eliminates the need for users to re-enter their credentials when logging into Witness because the information is automatically taken from the user’s session in the operating systems (e.g. Windows).

Currently Witness only supports authenticating the user against Microsoft Active Directory, however an additional plugin to support LDAP (Lightweight Directory Access Protocol) will be available soon.

Contents

Requirements

To enable SSO to authenticate against an Active Directory you must have the following:

1. An Active Directory domain account that has permission to query the directory. These account details must be entered in the Witness SSO plugin configuration so Witness has permission to access the directory server.

2. A matching account in Witness and Active Directory (AD). This is linked based on the username, for example if the user name is john.doe in AD then there must be a matching user account in Witness with the same username john.doe.

3. You need an Active Directory (AD) group to match each of the user groups in Witness. This enables the domain administrators to move users between groups in AD in order to change the users permissions in Witness. Each user group in Witness can be linked to a user group in Active Directory.

Enabling SSO

1. Within Settings > System Settings there is an SSO Settings section. Click the icon to view the settings:
   
   

   Open

   

    

2. The User can now configure or amend the settings to enable Witness to check against an Active Directory / LDAP server for Users and Groups:
   
   

   Open

   

    

   Enabled: Select to enable SSO.

   Server: There are several options:

   • Legacy Domain Name

   • Domain Name

   • Server Name

   • Server IP Address

   • Server Name or IP Address with Port

   Container: Can be a Common Name for searching within the directory.

   Username: The Domain / Directory User who can look up Users and Groups within the directory.

   Password: The password of the User.

3. Within the User Group settings there is an SSO Group Name field. This links this set of Witness permissions with user who are members of the linked AD group.
   
   

    

4. Select Edit to add an SSO Group Name. This name must match the exact name as it appears in the AD, as illustrated below.
   
   

    

5. When logging into Witness, there is an option Enable SSO. Select this to enable SSO.
   
   

    

Related Information